VRT Sign in

Api Management CVEs

3 CVEs, 1 exploited, 2 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 2 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5

3matches 2protected66.7% 1exploited33.3% 1CISA KEV33.3% 1public PoC33.3% 1EPSS ≥ 0.533.3%

Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0%

Critical 0 0.0% High 2 66.7% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 66.7%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Aug 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Sep 220 Oct 220 Nov 220 Dec 220 Jan 231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Feb 230 Mar 230 Apr 230 May 230 Jun 230 Jul 230 Aug 230 Sep 230 Oct 231 Mitigation candidate1 High1 not blocked1 Exploited1

Aug 22Oct 22Dec 22Feb 23Apr 23Jun 23Aug 23Oct 23

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2023-44487	High	2023-10-10	Mitigation candidate	Exploited	The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-38723	High	2023-01-03	Protected by Waratek	No public exploit	Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
CVE-2019-25075	Medium	2022-08-23	Protected by Waratek	No public exploit	HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2023-44487

High

2023-10-10

Mitigation candidate

Exploited

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2022-38723

High

2023-01-03

Protected by Waratek

No public exploit

Gravitee API Management before 3.15.13 allows path traversal through HTML injection.

CVE-2019-25075

Medium

2022-08-23

Protected by Waratek

No public exploit

HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.