Traffic Control
Monthly
Denial of service in Apache Traffic Control's Traffic Router component allows individuals with access to its management interface to submit malicious regular-expression patterns that are compiled and evaluated inefficiently. This causes CPU exhaustion and renders the Traffic Router unavailable; the impact is availability-only, with no confidentiality or integrity loss. All versions of the project are affected, no fix will be released because Apache Traffic Control is retired, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.74%, ~53rd percentile). Note that the published NVD vector records PR:N, but the authoritative assessment reflects the description's requirement for management-interface access (PR:L), meaning the attacker is not a fully anonymous internet user in practice.
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Denial of service in Apache Traffic Control's Traffic Router component allows individuals with access to its management interface to submit malicious regular-expression patterns that are compiled and evaluated inefficiently. This causes CPU exhaustion and renders the Traffic Router unavailable; the impact is availability-only, with no confidentiality or integrity loss. All versions of the project are affected, no fix will be released because Apache Traffic Control is retired, and no public exploit code or active exploitation has been identified at time of analysis (EPSS 0.74%, ~53rd percentile). Note that the published NVD vector records PR:N, but the authoritative assessment reflects the description's requirement for management-interface access (PR:L), meaning the attacker is not a fully anonymous internet user in practice.
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.