Server-Side Request Forgery (SSRF)

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Design/Logic Flaw

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

PT-2022-15905 · Apache · Apache Traffic Control Traffic Ops

Name of the Vulnerable Software and Affected Versions: Apache Traffic Control Traffic Ops versions prior to 6.1.0 Apache Traffic Control Traffic Ops versions prior to 5.1.6 Description: The issue allows an unprivileged user who can reach Traffic Ops over HTTPS to send a specially-crafted POST...

CVE-2022-23206: Server-Side Request Forgery (SSRF)

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Apache Traffic Control 安全漏洞

Apache Traffic Control is a distributed, scalable content distribution solution from the Apache Foundation. Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6 was vulnerable to a code issue that allowed unprivileged users who could reach traffic operations via HTTPS to send a special POST...

The vulnerability of the Apache Traffic Server web server arises from insufficient validation of input data, allowing attackers to trigger service interruptions.

The vulnerability of the Apache Traffic Server web server exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the LDAP filter in the Apache Traffic Control system, which is used to build CDN networks, allows attackers to execute arbitrary commands.

The vulnerability of the LDAP filter in the Apache Traffic Control system for building CDN networks exists because measures to neutralize specific elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by sending a...

Incorrect Permission Assignment for Critical Resource

When ORT now via atstccfg generates ipallow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are...

The vulnerability of the mechanism for verifying the authenticity of TLS connections on Apache Traffic Server allows a perpetrator to carry out a type of “man-in-the-middle” attack.

The vulnerability of the TLS authentication verification mechanism of the Apache Traffic Server web server is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

The vulnerability of the stats-over-http plugin in the Apache Traffic Server web server allows a hacker to cause a service failure.

The vulnerability of the stats-over-http plugin in the Apache Traffic Server web server is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability may allow a malicious actor to cause service interruptions remotely...

Apache Traffic Control LDAP filter injection vulnerability

Apache Traffic Control is a distributed and scalable content distribution solution from the Apache Foundation. An LDAP injection vulnerability exists in Apache Traffic Control, which stems from the fact that a user can send a request with a crafted username to any API version of the POST/login...

CVE-2021-43350

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

CVE-2021-43350

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

Design/Logic Flaw

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

CVE-2021-43350

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

CVE-2021-43350

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...