CVE-2024-45387

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45387
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr Mailing List
http://www.openwall.com/lists/oss-security/2024/12/23/3 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:*
History

11 Feb 2025, 16:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-89
CPE cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:*
First Time Apache traffic Control
Apache
References () http://www.openwall.com/lists/oss-security/2024/12/23/3 - () http://www.openwall.com/lists/oss-security/2024/12/23/3 - Mailing List
References () https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr - () https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr - Mailing List

23 Dec 2024, 18:15

Type Values Removed Values Added
CWE CWE-285
CWE-89
References
  • () http://www.openwall.com/lists/oss-security/2024/12/23/3 -

23 Dec 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-23 16:15

Updated : 2025-02-11 16:07

NVD link : CVE-2024-45387

Mitre link : CVE-2024-45387

JSON object : View

Products Affected

apache

  • traffic_control
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')