Threat Investigation
Request a demo

CVE-2021-20252

Medium

Description

A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability.

SeverityMedium
CVSS6.5
Exploit probability—
ProductRedhat 3scale Api Management
PublishedFeb 23, 2021
First seenFeb 23, 2021
Weakness typeCWE-20Improper input validation

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

ProductAffected versionsFixed in
redhat 3scale_api_management2.0—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.