Read the docs
TI-2023-04521 Aliases CVE-2023-4910GHSA-g849-x577-8j36

3scale-admin-portal: logged out users tokens can be accessed

Priority MEDIUM 58CWE-668Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-668 and the CVSS impact.

Summary

A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat 3scale API Management Platform 2——No fix listedCNA
  • Red Hat 3scale API Management Platform 2 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:3scale_api_management:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:3scale_api_management:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4910
  2. 2026-10-03 Alias added: GHSA-g849-x577-8j36

References

Advisory 1

Other 1

  • TI-2026-34281 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVSS 3.1HIGH 7.5
  • TI-2022-01295 Improper input validation in 3scale-amp-system CVSS 3.1HIGH 8.8
  • TI-2024-09540 Incorrect authorization in gateway CVSS 3.1HIGH 7.5
  • TI-2021-02598 Missing authorization in KVM CVSS 3.1HIGH 8.8
  • TI-2019-07536 In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its… CVSS 3.1HIGH 7.8
  • TI-2022-00257 A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver… CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences