by Kastro
Paper/Archive/CVE-2021-43350

CVE-2021-43350

Apache Software Foundation Apache Traffic Control — LDAP filter injection vulnerability in Traffic Ops

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.9.919 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

Affected

ProductAffectedFixed inSource
Apache Traffic ControlTraffic Ops – < 6.0.16.0.1CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftrafficcontrol.apache.org/securityrefopenwall.com/lists/oss-security/2021/11/11/3refopenwall.com/lists/oss-security/2021/11/11/4refopenwall.com/lists/oss-security/2021/11/17/1