CVE-2024-45387

Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

State: Published
Severity: 9.9 Critical
Published: Dec 23, 2024
Updated: Dec 24, 2024
Reserved: Aug 28, 2024

Description

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request.

Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	apache

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-285 Improper Authorization

Affected Products

Product	Versions
Apache Traffic ControlApache Software Foundation	8.0.0 through 8.0.1Affected 7.0.0 to before 8.0.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.