CVE-2019-14836

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	Red Hat 3scale API Management	Red Hat 3scale API Management 2.10.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1847605Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1847605Vendor Advisory

Timeline

Published: May 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148379.1A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing o CVE-2019-148384.9A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to mod CVE-2019-148397.5It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when CVE-2019-14847.8A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code CVE-2019-148407.5A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials CVE-2019-148418.8A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an att CVE-2019-148429.8Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed CVE-2019-148438.8A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used CVE-2019-148447.5A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending o CVE-2019-148455.3A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hos CVE-2019-148467.8In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG CVE-2019-148474.9A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync res