High severity · published Mar 18, 2021
CVE-2019-14852
A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3A
3scale Api Management · Redhat
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14852
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1758208
More from 3scale Api Management
8.8
CVE-2022-1414
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields
8.8
CVE-2021-3656
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization
7.8
CVE-2022-0330
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU
7.8
CVE-2019-10216
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions
7.5
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection