CVE-2022-1414

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1173 CWE-20

Affected software

Vendor	Product	Versions
n/a	3scale-amp-system	3scale-amp-system as shipped in 3scale-AMP 2

References

https://access.redhat.com/security/cve/CVE-2022-1414Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2076794Issue Tracking, Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-1414Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2076794Issue Tracking, Vendor Advisory

Timeline

Published: Oct 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14158.8A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authen CVE-2022-14165.4Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versio CVE-2022-14174.3Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14186.1The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no CVE-2022-14197.8The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created i CVE-2022-14205.5Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.CVE-2022-14214.3The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary CVE-2022-14226.5The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an CVE-2022-14238.8Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions CVE-2022-14246.5The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in us CVE-2022-14254.3The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message CVE-2022-14263.7An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.