CVE-2021-43350

Critical

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint…

apache·CWE-74·Published 2021-11-11

CVSS

9.8

EPSS

0.04

KEV

Exploits

cve.orgen

210 chars

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

NVDen

210 chars

OSV.deven

99 chars

Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol

GHSAen

212 chars

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST `/login` endpoint of any API version to inject unsanitized content into the LDAP filter.

NVDes

250 chars

Un usuario no autenticado de Apache Traffic Control Traffic Ops puede enviar una petición con un nombre de usuario especialmente diseñado al endpoint POST /login de cualquier versión de la API para inyectar contenido no desinfectado en el filtro LDAP

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.5	10.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H