Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-72E17071B2E7C8DF37FFFEA5CC7340DF

HistoryNov 11, 2021 - 12:00 a.m.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

2021-11-1100:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

0.006 Low

EPSS

Percentile

78.7%

JSON

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

CPENameOperatorVersion
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginge5.1.0
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginlt5.1.4
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginge6.0.0
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginlt6.0.1

Name	Operator	Version
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	ge	5.1.0
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	lt	5.1.4
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	ge	6.0.0
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	lt	6.0.1