PT-2024-9752 · Apache+1 · Apache Traffic Control+1

Yuan Luo · Published 2024-08-28 · Updated 2025-01-10 · CVE-2024-45387

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Control versions 8.0.0 through 8.0.1

Description A critical SQL injection vulnerability in Apache Traffic Control allows a privileged user with roles such as "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially crafted PUT request. This flaw can be easily exploited, potentially compromising sensitive data and disrupting critical services. It is estimated that over 365,000 services may be affected.

Recommendations Update to version 8.0.2 as soon as possible to patch the vulnerability. Audit access permissions for high-risk roles. Double-check database configurations for security loopholes.

Fix

Improper Authorization

SQL injection

Weakness Enumeration

CWE-285

CWE-89

Related Identifiers

BDU:2024-11488

CVE-2024-45387

GHSA-VQ94-9PFV-CCQR

GO-2024-3358

OPENSUSE-SU-2025:14624-1

OPENSUSE-SU-2025_0060-1

SUSE-SU-2025:0060-1

Affected Products

Apache Traffic Control

Suse

References · 90

• https://bdu.fstec.ru/vul/2024-11488 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45387 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3358 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14624-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45387 · Security Note
• https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0060-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vq94-9pfv-ccqr · Vendor Advisory
• https://github.com/apache/trafficcontrol · Note
• https://github.com/apache/trafficcontrol/releases/tag/v8.0.2 · Note
• https://twitter.com/infosecanon/status/1872075871286407613 · Twitter Post
• https://suse.com/security/cve/CVE-2024-12678 · Note
• https://twitter.com/abuyv/status/1874704456123813996 · Twitter Post
• https://suse.com/security/cve/CVE-2024-54148 · Note
• https://t.me/proxy_bar/2463 · Telegram Post