Read the docs
TI-2017-05155 Aliases CVE-2017-7512GHSA-6574-p8rp-gxqh

Incorrect authorization in 3scale AMP before 2.0.0

Priority MEDIUM 46CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

Why it matters now

EPSS 0.02163 82nd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—3scale AMP before 2.0.03scale AMP before 2.0.0—No fix listedCNA
  • 3scale AMP before 2.0.0 Vendor— Affected 3scale AMP before 2.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:3scale_api_management_platform:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:3scale_api_management_platform:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2017:1712 Released 2017-07-06 · Red Hat rating Important
    Red Hat 3scale API Management Platform 2.0.0 security update
    • RHAMP-2.0 3scale-amp20/memcached@facdf907b2eda22f0f5604c8e068adbbdb6b7e1bdeb2800cf42ce3299d5f6523_amd64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHAMP-2.0Fixed RHSA-2017:1712

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7512
  2. 2026-10-03 Alias added: GHSA-6574-p8rp-gxqh

References

Advisory 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2024-08973 System: pdf invoices of the developer users can be seen if the url is known CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences