High severity · published Oct 19, 2022
CVE-2022-1414
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3S
3scale-amp-system ·
3scale-amp-system as shipped in 3scale-AMP 2 · source: vendor
3A
3scale Api Management · Redhat
2.0 · source: NVD