{"affected":[{"defaultStatus":"unknown","ecosystem":"https://github.com/3scale","packageName":"3scale","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"2.13.6","status":"affected","version":"2.13.0","versionType":"semver"},{"status":"affected","version":"2.14.0"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"3scale-amp2/system-rhel7","product":"Red Hat 3scale API Management Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2024-9671","cwes":["CWE-862"],"description":"A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed.","epss":{"date":"2026-11-05","percentile":0.20948,"score":0.00283},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793889925227,"publishedAt":1728484330972,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-9671"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317449"}],"remediation":[],"revision":"6ada5db561d3f376842bf1249ea40bce25f4512d4b4371760889f76733416915","sources":[{"modifiedAt":1793889925227,"name":"CNA: redhat","retrievedAt":1793891327274,"url":"https://www.cve.org/CVERecord?id=CVE-2024-9671"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793891332260,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9671"}],"ssvc":{"assessedAt":1728490600968,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"System: pdf invoices of the developer users can be seen if the url is known","updatedAt":1793891332260}