CVE-2021-23365

CVE-2021-23365 affects github.com/tyktechnologies/tyk-identity-broker (pre-1.1.1). Root cause is insecure XML handling by the Go XML parser during encoding/decoding, permitting authentication bypass of SAML authentication. Impact is partial confidentiality/integrity concerns with the authenticati...

Directory traversal

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this valu...

CVE-2021-23357 Directory Traversal

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this valu...