GitHub Advisoryadvisory · Go

GHSA-mg2c-rc36-p594 Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection

CRITICAL Published 2022-05-24 Modified 2024-06-10 Official page ↗
Aliases
CVE-2021-43350
Ecosystem
Go
Packages
github.com/apache/trafficcontrol
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2024-04-24

Affected packages

• Go github.com/apache/trafficcontrol: >= 6.0.0, < 6.0.1 → fixed in 6.0.1 • Go github.com/apache/trafficcontrol: >= 5.1.0, < 5.1.4 → fixed in 5.1.4

Description

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST `/login` endpoint of any API version to inject unsanitized content into the LDAP filter.

Related

Alias · CVE (1)

  • CVE-2021-43350 An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References