CVE-2024-45387criticalCWE-285CWE-89

CVE-2024-45387: critical vulnerability in Apache Traffic Control

Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

Published · Updated

Follow this CVE+ Monitor Apache Traffic Control+ Monitor github.com/apache/trafficcontrol

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 66%
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Traffic Control
Related CVEs — Apache Traffic Control

In the same product, most dangerous first.

CVE-2021-43350—LDAP filter injection vulnerability in Traffic OpsEPSS 4.8%CVE-2017-7670—CVE-2017-7670EPSS 4.7%CVE-2021-42009—Apache Traffic Control Traffic Ops Email Injection VulnerabilityEPSS 2.8%CVE-2022-23206—Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthEPSS 2.0%CVE-2025-61581HIGHApache Traffic Control: ReDoS issue in Traffic Router configurationEPSS 0.7%