CVE-2021-43350 LDAP filter injection vulnerability in Traffic Ops

2021-11-1113:00:15

CWE-90

apache

www.cve.org

9.7 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.7%

JSON

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

CNA Affected

[
  {
    "product": "Apache Traffic Control",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "5.1.4",
            "status": "unaffected"
          }
        ],
        "lessThan": "6.0.1",
        "status": "affected",
        "version": "Traffic Ops",
        "versionType": "custom"
      }
    ]
  }
]