PT-2021-23468 · Apache · Apache Traffic Control

Eric Friedrich + 1 · Published 2021-10-12 · Updated 2024-08-21 · CVE-2021-42009

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Control versions 4.1.x through 5.1.x

Description An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the "/deliveryservices/request" Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address.

Recommendations For Apache Traffic Control 4.1.x, upgrade to 5.1.3. For Apache Traffic Control 5.1.x, upgrade to 5.1.3 or 6.0.0.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-42009

GHSA-GW97-F6H8-GM94

GO-2022-0602

Affected Products

Apache Traffic Control

References · 14

• https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927c1533d06d702af%40%3Cdev.trafficcontrol.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0602 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gw97-f6h8-gm94 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42009 · Security Note
• https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3E · Vendor Advisory
• https://github.com/apache/trafficcontrol · Note
• https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87@%3Cannounce.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2021/10/12/1 · Note
• https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb@%3Cdev.trafficcontrol.apache.org%3E · Note
• https://t.me/cibsecurity/30375 · Telegram Post
• https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb%40%3Cdev.trafficcontrol.apache.org%3E · Note
• https://github.com/advisories/GHSA-gw97-f6h8-gm94 · Note