Description
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens.
For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Google Cloud | Apigee-X | < 1.14.4, < 1.15.2, < 1.16.1 | 1.14.4 |