CVE-2019-12405
- State
- Published
- Severity
- Not scored
- Published
- Sep 9, 2019
- Updated
- Aug 4, 2024
- Reserved
- May 28, 2019
Description
Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Traffic ControlApache |
|
References
- [trafficcontrol-users] 20190906 CVE-2019-12405: Apache Traffic Control LDAP-based authentication vulnerabilitymailing-list
- https://support.f5.com/csp/article/K84141859
- https://support.f5.com/csp/article/K84141859?utm_source=f5support&%3Butm_medium=RSS
- [trafficcontrol-commits] 20210616 [trafficcontrol-website] branch asf-site updated: Fix CVE-2020-17522 linkmailing-list
- [trafficcontrol-commits] 20211011 [trafficcontrol-website] 01/02: Add CVE-2021-42009mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.