{"id":"CVE-2024-12125","aliases":["EUVD-2024-55065","GHSA-7fc5-p6pg-8vrj"],"status":"published","title":"3scale-porta: readonly fields not validated server-side","description":"A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00267,"percentile":0.19034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-281"],"published":"2025-11-06T21:50:40Z","modified":"2026-11-04T21:09:13Z","products":[{"vendor":"3scale","product":"porta"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-12125","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330214","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12125","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7fc5-p6pg-8vrj"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/3scale/porta/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12125.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-12125","title":"3scale-porta: readonly fields not validated server-side","description":"A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.","status":"published","published":"2025-11-06T21:50:40.704Z","modified":"2026-11-04T21:09:13.781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-281"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2024-55065","description":"A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.","status":"published","published":"2025-11-06T21:50:40Z","modified":"2026-11-04T21:09:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-04T22:46:32.144626Z"}],"ghsa":[{"id":"GHSA-7fc5-p6pg-8vrj","title":"A flaw was found in the 3scale developer portal. This issue can allow account creation or updates...","description":"A flaw was found in the 3scale developer portal. This issue can allow account creation or updates passed through hidden or read-only fields, the contents of which may be altered. This flaw allows an attacker to access or modify restricted information.","status":"published","published":"2025-11-07T00:30:29Z","modified":"2025-11-07T00:30:30Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T15:04:41.90926Z"}],"nvd":[{"id":"CVE-2024-12125","description":"A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.","status":"published","published":"2025-11-06T22:15:37.11Z","modified":"2026-11-09T10:10:00.217Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-281"],"updated_at":"2026-11-09T12:13:53.993003Z"}],"osv":[{"id":"CVE-2024-12125","title":"3scale-porta: readonly fields not validated server-side","description":"A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.","status":"published","published":"2025-11-06T21:50:40.704Z","modified":"2026-11-11T02:30:59.06208992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-281"],"updated_at":"2026-11-11T11:06:27.455443Z"}]}}