CVE-2024-45387
Critical
Description
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.
SeverityCritical
CVSS9.9
Exploit probability—
Product
Apache Traffic Control
PublishedDec 23, 2024
First seenDec 23, 2024
Weakness typeCWE-89SQL injectionCWE-285CWE-285
How to fix
Update
- apache traffic_control8.0.2 or later
- github.com/apache/trafficcontrol/v88.0.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache traffic_control | 8.0.0 ≤ v < 8.0.2 | 8.0.2 |
| github.com/apache/trafficcontrol/v8Go | 8.0.0 ≤ v < 8.0.2 | 8.0.2 |
| github.com/apache/trafficcontrolGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.