CVE-2017-7512

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	3scale AMP before 2.0.0	3scale AMP before 2.0.0

References

https://access.redhat.com/errata/RHSA-2017:1712
https://access.redhat.com/security/cve/cve-2017-7512Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1457997Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1712
https://access.redhat.com/security/cve/cve-2017-7512Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1457997Issue Tracking, Vendor Advisory

Timeline

Published: Jul 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75135.4It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host CVE-2017-75145.4A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user ab CVE-2017-75155.5poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.CVE-2017-75173.5An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces CVE-2017-75187.8A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulatio CVE-2017-75194.4In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service usin CVE-2017-75207.4OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-i CVE-2017-75215.9OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks a CVE-2017-75226.5OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certifica CVE-2017-75237.5Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting int CVE-2017-75247.5tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when gene CVE-2017-75259.8A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica