CVE-2025-13292

CVE-2025-13292 affects Google Apigee-X, enabling cross-tenant unauthorized read/write access to Apigee Analytics data and logs due to improper access control. Patched in version 1-16-0-apigee-3; no user action required. Evidence confirms affected product, impact, and patch; exploitation details a...

EUVD-2025-201493

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...

Google Apigee-X 安全漏洞

Google Apigee-X is a next-generation API management platform from Google Inc USA. A security vulnerability exists in Google Apigee-X that stems from improper authorization and could lead to unauthorized data access...

PT-2025-49328

Name of the Vulnerable Software and Affected Versions Apigee-X versions prior to 1-16-0-apigee-3 Description A security issue in Apigee-X could allow an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations...

CVE-2025-13426

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...

CVE-2025-13426 Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...

CVE-2025-13426

CVE-2025-13426 affects Google Apigee’s JavaCallout policy. A crafted JavaCallout could inject a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, enabling unauthorized data access and lateral movement. Public disclosures in the initial documen...

CVE-2025-13426 Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...

Google Apigee hybrid Javacallout policy 安全漏洞

Google Apigee hybrid Javacallout policy is a next-generation API management platform from Google, Inc USA. A security vulnerability exists in Google Apigee hybrid Javacallout policy that stems from a JavaCallout policy that allows the injection of malicious objects, which could lead to remote cod...

PT-2025-49315

Name of the Vulnerable Software and Affected Versions Google Apigee versions prior to Hybrid 1.11.2 Google Apigee versions prior to Hybrid 1.12.4 Google Apigee versions prior to Hybrid 1.13.3 Google Apigee versions prior to Hybrid 1.14.1 Google Apigee versions prior to OPDK 5202 Google Apigee...

Malicious code in apigee-cli (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6625 Malicious code in apigee-cli (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Apigee API Security policies howto

The Genesis of Apigee API Security Guidelines In today's digital epoch, APIs Application Programming Interfaces" have ascended to be the fundamental infrastructure underpinning software development - furnishing the medium for diverse software systems to interact and exchange data. Yet, with this...

Drupal Releases Security Update to Address a Vulnerability in Apigee Edge

Drupal released a security update to address a vulnerability affecting the Apigee Edge module for Drupal 9.x. An attacker could exploit this vulnerability to bypass access authorization or disclose sensitive information. CISA encourages users and administrators to review Drupal’s security advisor...

DRUPAL-CONTRIB-2023-005

The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. Previous module versions did not support entity query level access checking, which could have led to information disclosure or access bypass in various places...

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2023-005

The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. Previous module versions did not support entity query level access checking, which could have led to information disclosure or access bypass in various places...

DRUPAL-CONTRIB-2022-045

The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. The developers user can view API keys for their respective Apps. The module discloses information by allowing attackers to view cached information of API Keys from the browser cache for...

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2022-045

The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. The developers user can view API keys for their respective Apps. The module discloses information by allowing attackers to view cached information of API Keys from the browser cache for...

DRUPAL-CONTRIB-2021-020

The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. The module did not properly validate user access for data creation in certain circumstances...

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2021-020

The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. The module did not properly validate user access for data creation in certain circumstances...