CVE-2024-45387

Description

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 50.55%• Percentile: 98%

Techniques & Countermeasures

• CWE-89•Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

• CWE-285•Improper Authorization

  The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

• apache software foundation•apache traffic control

  ≥ 8.0.0, ≤ 8.0.1

• apache•traffic_control

  ≥ 8.0.0, < 8.0.2

• github.com/apache•trafficcontrol

  all

• github.com/apache/trafficcontrol•v8

  ≥ 8.0.0, < 8.0.2

References (6)

• https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr
• http://www.openwall.com/lists/oss-security/2024/12/23/3
• https://nvd.nist.gov/vuln/detail/CVE-2024-45387
• https://github.com/apache/trafficcontrol
• https://github.com/apache/trafficcontrol/releases/tag/v8.0.2
• https://github.com/advisories/GHSA-vq94-9pfv-ccqr