Description
A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | 3scale | 2.13.0 – < 2.13.6, 2.14.0 | 2.13.6 |
| Red Hat | Red Hat 3scale API Management Platform 2 | — | — |
References
- https://access.redhat.com/security/cve/CVE-2024-9671 vdb-entry
- RHBZ#2317449 issue-tracking