PT-2019-4643 · Apache · Apache Traffic Control

Published 2019-09-09 · Updated 2022-04-18 · CVE-2019-12405

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Control versions 3.0.0 through 3.0.1

Description The issue is related to improper authentication in the Traffic Ops API component when LDAP is enabled for login. This allows an attacker to authenticate as a user without knowing the correct password, given that they have a username that can be authenticated via LDAP.

Recommendations For Apache Traffic Control versions 3.0.0 and 3.0.1, consider disabling LDAP authentication in the Traffic Ops API component until a patch is available. Restrict access to the Traffic Ops API to minimize the risk of exploitation. Avoid using the Traffic Ops API for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2020-00809

CVE-2019-12405

GHSA-3F8R-4QWM-R7JF

Affected Products

Apache Traffic Control

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2019-12405 · Security Note
• https://osv.dev/vulnerability/GHSA-3f8r-4qwm-r7jf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12405 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00809 · Security Note
• https://github.com/apache/trafficcontrol · Note
• https://github.com/apache/trafficcontrol/commit/f780aff77a52d52a37b4d1cc3e8e801c0b557356 · Note
• https://support.f5.com/csp/article/K84141859 · Note
• https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf%40%3Ccommits.trafficcontrol.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf@%3Ccommits.trafficcontrol.apache.org%3E · Note
• https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8@%3Ccommits.trafficcontrol.apache.org%3E · Note
• https://support.f5.com/csp/article/K84141859?utm_source=f5support&utm_medium=RSS · Note
• https://support.f5.com/csp/article/K84141859?utm_source=f5support&amp%3Butm_medium=RSS · Note
• https://lists.apache.org/thread.html/e128e9d382f3b0d074e2b597ac58e1d92139394509d81ddbc9e3700e%40%3Cusers.trafficcontrol.apache.org%3E · Note
• https://lists.apache.org/thread.html/e128e9d382f3b0d074e2b597ac58e1d92139394509d81ddbc9e3700e@%3Cusers.trafficcontrol.apache.org%3E · Note
• https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E · Note