CVE-2023-0456

A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.

Score

CVSS 3.1 7.5 High

Status

Modified - secalert@redhat.com

Published

2023-09-27

Last modified

2024-09-24

Weaknesses

CWE-285, CWE-862

Affected products

• Apicast (Redhat)
• Red Hat 3scale Amp (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2023-0456
• https://bugzilla.redhat.com/show_bug.cgi?id=2163586