Not rated
CVE-2021-43350 An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the…
Description
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Traffic Control 6.0 | earliest → < 6.0.1 | 6.0.1 |
References
- trafficcontrol.apache.org trafficcontrol.apache.org
- [oss-security] 20211111 CVE-2021-43350: Apache Traffic Control: LDAP filter injection vulnerability in Traffic Ops www.openwall.com
- [oss-security] 20211111 Re: CVE-2021-43350: Apache Traffic Control: LDAP filter injection vulnerability in Traffic Ops www.openwall.com
- [oss-security] 20211116 Re: CVE-2021-43350: Apache Traffic Control: LDAP filter injection vulnerability in Traffic Ops www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Traffic Control
The 6 CVEs of Apache Traffic Control →
CVE-2025-61581
** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control
Not rated
CVE-2024-45387
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role…
9.9
Critical
CVE-2022-23206
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS…
Not rated
CVE-2021-42009
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a…
Not rated