High severityNVD Advisory· Published Dec 23, 2024· Updated Dec 24, 2024
Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
CVE-2024-45387
Description
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request.
Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/apache/trafficcontrol/v8Go | >= 8.0.0, < 8.0.2 | 8.0.2 |
Affected products
5- ghsa-coords4 versionspkg:golang/github.com/apache/trafficcontrol/v8pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6
>= 8.0.0, < 8.0.2+ 3 more
- (no CPE)range: >= 8.0.0, < 8.0.2
- (no CPE)range: < 0.0.20250108T191942-150000.1.26.1
- (no CPE)range: < 0.0.20250108T191942-1.1
- (no CPE)range: < 0.0.20250108T191942-150000.1.26.1
- Range: 8.0.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-vq94-9pfv-ccqrghsaADVISORY
- lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trrghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-45387ghsaADVISORY
- www.openwall.com/lists/oss-security/2024/12/23/3ghsaWEB
- github.com/apache/trafficcontrol/releases/tag/v8.0.2ghsaWEB
News mentions
0No linked articles in our index yet.