{"api_version":"1","generated_at":"2026-04-22T23:23:04+00:00","cve":"CVE-2021-3412","urls":{"html":"https://cve.report/CVE-2021-3412","api":"https://cve.report/api/cve/CVE-2021-3412.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-3412","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-3412"},"summary":{"title":"CVE-2021-3412","description":"It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2021-06-01 14:15:00","updated_at":"2022-06-03 17:24:00"},"problem_types":["CWE-307"],"metrics":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928301","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1928301","refsource":"MISC","tags":[],"title":"1928301 – (CVE-2021-3412) CVE-2021-3412 3scale: lack of brute force protection on dev portal login","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3412","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3412","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"3412","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"3scale","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"3412","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"3scale_api_management","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2021-3412","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-307","cweId":"CWE-307"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"3Scale","version":{"version_data":[{"version_affected":"=","version_value":"all versions"}]}}]}}]}},"references":{"reference_data":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928301","refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1928301"}]}},"nvd":{"publishedDate":"2021-06-01 14:15:00","lastModifiedDate":"2022-06-03 17:24:00","problem_types":["CWE-307"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:3scale_api_management:2.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:3scale:*:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"3412","Ordinal":"202492","Title":"CVE-2021-3412","CVE":"CVE-2021-3412","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"3412","Ordinal":"1","NoteData":"It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"3412","Ordinal":"2","NoteData":"2021-06-01","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"3412","Ordinal":"3","NoteData":"2021-06-01","Type":"Other","Title":"Modified"}]}}}