← Vulnerability feed

Vulnerability record · CVE-2017-7512 · published 7 July 2017

CVE-2017-7512: Redhat 3scale api management platform incorrect authorization vulnerability

Redhat · 3scale Api Management Platform

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

9.8 CVSS 3.0 Critical EPSS 2.2% · top 17.5% CWE-863 · Incorrect authorization
9.8CVSS 3.0 base score, v2 7.5
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2017:1712
https://access.redhat.com/security/cve/cve-2017-7512 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1457997 Issue TrackingVendor Advisory
https://access.redhat.com/errata/RHSA-2017:1712
https://access.redhat.com/security/cve/cve-2017-7512 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1457997 Issue TrackingVendor Advisory

Track CVE-2017-7512 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed8.7CVE-2026-29063Immutable-js immutable prototype pollution vulnerabilityImmutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immuta…EPSS 0.99%5.3CVE-2024-9671Redhat 3scale api management platform missing authorization vulnerabilityA vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invo…EPSS 0.28%9.8CVE-2026-123218Ibm aspera faspex incorrect authorization vulnerabilityIBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administ…KEVEPSS 0.53%9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 92%8.8CVE-2026-42016JFrog Artifactory token scope bypass enables privilege escalationJFrog Artifactory (Self Hosted) before 7.133.11 validates a token's signature and issuer but not its scope, so a token can be used for actions beyond…KEVEPSS 8.6%analysed10.0CVE-2025-54253Adobe Experience Manager Forms misconfiguration allows pre-auth code executionAdobe Experience Manager Forms 6.5.23 and earlier contain a misconfiguration (CWE-863, incorrect authorization) that lets an attacker bypass security…KEVEPSS 81%analysed5.4CVE-2025-55177WhatsApp iOS and Mac linked-device sync authorization flawWhatsApp for iOS, WhatsApp Business for iOS and WhatsApp for Mac fail to fully authorize linked-device synchronization messages, letting an unrelated…KEVEPSS 14%analysed

Source: NIST National Vulnerability Database (record CVE-2017-7512), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.