Vulnerabilities

TI-2023-22554 CVE-2023-42284 · GHSA-w8wr-v3q8-68hg

Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker…

HIGH 82

Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01562 Published 2023-11-07 No fix listed CWE-89

TI-2023-22553 CVE-2023-42283 · GHSA-ff49-v6jj-fh2j

HIGH 82

Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01562 Published 2023-11-07 No fix listed CWE-89

TI-2021-06053 CVE-2021-23357 · GHSA-3qx7-r2pf-8cwr

LOW 25

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00525 Published 2021-03-15 No fix listed CWE-22