CVE-2019-14852

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Mar 18, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-148537.5An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexCVE-2019-148546.5OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to DebCVE-2019-148557.5A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use thisCVE-2019-148566.5ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a NoneCVE-2019-148576.1A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019CVE-2019-148585.5A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramCVE-2019-148599.1A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. WithoutCVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URLCVE-2019-148606.5It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lackCVE-2019-148615.3All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPCCVE-2019-148626.1There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web applicationCVE-2019-148636.1There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli
CVE-2019-14852: High severity, CVSS 7.5 | Vulnix