CVE-2021-42009
Medium
Description
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Apache Traffic Control
PublishedOct 12, 2021
First seenOct 12, 2021
Weakness typeCWE-20Improper input validation
How to fix
Update
- apache traffic_control5.1.3 or later
- github.com/apache/trafficcontrol5.1.3, 5.1.3+incompatible or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache traffic_control | 4.1.0 ≤ v < 5.1.3 | 5.1.3 |
| github.com/apache/trafficcontrolGo | v < 5.1.3, v < 5.1.3+incompatible | 5.1.3, 5.1.3+incompatible |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.