CVE-2021-3814

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381409.8The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after se CVE-2021-381428.8Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network CVE-2021-381436.1An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to l CVE-2021-381445.4An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submissi CVE-2021-381459.8An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (clie CVE-2021-381467.5The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p CVE-2021-381477.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti CVE-2021-381489.8Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.CVE-2021-381495.4index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38159.8utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-381506.5When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP CVE-2021-381515.4index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.