5.5
Medium
CVE-2023-4910 3scale-admin-portal: logged out users tokens can be accessed
Description
A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Versions not published |
Other CVEs of Red Hat 3scale API Management Platform 2
The 65 CVEs of Red Hat 3scale API Management Platform 2 →
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
High
CVE-2026-54297
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters
7.5
High
CVE-2026-12143
form-data is a library for creating readable multipart/form-data streams
8.7
High
CVE-2026-44486
Axios is a promise based HTTP client for the browser and Node.js
7.5
High