Vulnerabilities

TI-2023-22554 CVE-2023-42284 · GHSA-w8wr-v3q8-68hg

Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker…

HIGH 82

Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01247 Published 2023-11-07 No fix listed CWE-89

TI-2023-22553 CVE-2023-42283 · GHSA-ff49-v6jj-fh2j

Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to…

HIGH 82

Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01247 Published 2023-11-07 No fix listed CWE-89

TI-2021-06060 CVE-2021-23365 · GHSA-599h-8wpj-75xj

Authentication bypass in github.com/TykTechnologies/tyk-identity-broker

MEDIUM 41

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01011 Published 2021-04-26 Fixed in 1.1.1 CWE-287

TI-2021-06053 CVE-2021-23357 · GHSA-3qx7-r2pf-8cwr

Directory traversal in github.com/TykTechnologies/tyk/gateway

LOW 25

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00525 Published 2021-03-15 No fix listed CWE-22

Vulnerabilities

Filters

Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker…

Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to…

Authentication bypass in github.com/TykTechnologies/tyk-identity-broker

Directory traversal in github.com/TykTechnologies/tyk/gateway