CVE-2022-23206: falha em Apache Traffic Control
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.0%
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
Produtos afetados
Apache Software Foundation · Apache Traffic ControlCVEs relacionadas — Apache Traffic Control
No mesmo produto, das mais perigosas para as menos.
CVE-2024-45387CRITICALApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsEPSS 66.1%CVE-2021-43350—LDAP filter injection vulnerability in Traffic OpsEPSS 4.8%CVE-2017-7670—CVE-2017-7670EPSS 4.7%CVE-2021-42009—Apache Traffic Control Traffic Ops Email Injection VulnerabilityEPSS 2.8%CVE-2025-61581HIGHApache Traffic Control: ReDoS issue in Traffic Router configurationEPSS 0.7%