Medium severity · published Jun 2, 2021
CVE-2020-14388
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3A
3scale Api Management · Redhat
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14388
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1875553
More from 3scale Api Management
8.8
CVE-2022-1414
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields
8.8
CVE-2021-3656
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization
7.8
CVE-2022-0330
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU
7.8
CVE-2019-10216
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions
7.5
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection