CVE-2021-42009

🗓️ 12 Oct 2021 07:40:11Reported by apacheType

cve🔗 web.nvd.nist.gov👁 86 Views🌐 WEB

Authenticated user can send crafted email to Traffic Ops endpoint, triggering email from server

Reporter	Title	Published	Views	Family All 18
attackerkb	CVE-2021-42009	12 Oct 202108:15	–	attackerkb
Circl	CVE-2021-42009	12 Oct 202112:25	–	circl
CNNVD	Apache Traffic Control 输入验证错误漏洞	12 Oct 202100:00	–	cnnvd
CNVD	Apache Traffic Control input validation error vulnerability	15 Oct 202100:00	–	cnvd
Cvelist	CVE-2021-42009 Apache Traffic Control Traffic Ops Email Injection Vulnerability	12 Oct 202107:40	–	cvelist
EUVD	EUVD-2021-2206	7 Oct 202500:30	–	euvd
Github Security Blog	Email relay in Apache Traffic Control	13 Oct 202118:55	–	github
GitLab Advisory Database	Improper Input Validation	13 Oct 202100:00	–	gitlab
GitLab Advisory Database	Improper Input Validation	12 Oct 202100:00	–	gitlab
Mend	CVE-2021-42009	12 Oct 202107:40	–	mend

NVD

Vulners

Node

apache traffic_controlRange4.1.0–5.1.3

[
  {
    "product": "Apache Traffic Control",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "5.0.0",
            "status": "affected"
          }
        ],
        "lessThan": "Apache Traffic Control*",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927c1533d06d702af%40%3Cdev.trafficcontrol.apache.org%3E
lists	www.lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87%40%3Cannounce.apache.org%3E
lists	www.lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3E
openwall	www.openwall.com/lists/oss-security/2021/10/12/1
lists	www.lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb%40%3Cdev.trafficcontrol.apache.org%3E

Parameter	Position	Path	Description	CWE
subject	request body	/deliveryservices/request	Authenticated Traffic Ops user with Portal-level privileges can send a request to the /deliveryservices/request endpoint with a specially crafted email subject to cause the Traffic Ops server to send an email to an arbitrary address with an arbitrary body.	CWE-20

17 Jun 2026 04:09Current

5.7Medium risk

Vulners AI Score5.7

CVSS 24

CVSS 3.14.3

EPSS0.02824

CWE-20