How severe is CVE-2021-20252?

CVE-2021-20252 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-20252 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-20252?

CVE-2021-20252 affects Redhat 3scale Api Management. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-20252?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-20252 published?

CVE-2021-20252 was published on 2021-02-23 and last updated on 2026-06-17.

CVE-2021-20252

CVE-2021-20252 is a medium-severity vulnerability in Redhat 3scale Api Management with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 6.8
EPSS exploit prediction: 1% (58th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Redhat 3scale Api Management
Published: 2021-02-23
Last modified: 2026-06-17

Description

A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability.

Frequently asked questions

What is CVE-2021-20252?: A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability.
How severe is CVE-2021-20252?: CVE-2021-20252 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-20252 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-20252?: CVE-2021-20252 affects Redhat 3scale Api Management. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-20252?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-20252 published?: CVE-2021-20252 was published on 2021-02-23 and last updated on 2026-06-17.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1928302

Affected products (1)

cpe:2.3:a:redhat:3scale_api_management:2.0:*:*:*:*:*:*:*

More vulnerabilities in Redhat 3scale Api Management

CVE-2022-1414 — High (CVSS 8.8): 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user…
CVE-2021-3656 — High (CVSS 8.8): A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the…
CVE-2022-0330 — High (CVSS 7.8): A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may…
CVE-2019-10216 — High (CVSS 7.8): In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling…
CVE-2024-10295 — High (CVSS 7.5): A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly…
CVE-2019-14852 — High (CVSS 7.5): A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic…

All CVEs affecting Redhat 3scale Api Management →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →