|Summary:||CVE-2020-14388 3scale-system: member role permissions bypass when editing services|
|Product:||[Other] Security Response||Reporter:||Chess Hazlett <chazlett>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||NEW ---||QA Contact:|
|Fixed In Version:||Doc Type:||If docs needed, set a value|
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:|
Description Chess Hazlett 2020-09-03 18:26:21 UTC
It was found that member permissions for an API's admin portal in 3scale were not properly enforced. An authenticated user could use this flaw to bypass normal account restrictions and access API services they do not have permissions for.