Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-888C08597143DE3C16DB1C475A3B9850

HistoryFeb 06, 2022 - 12:00 a.m.

Server-Side Request Forgery (SSRF)

2022-02-0600:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

0.001 Low

EPSS

Percentile

36.2%

JSON

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.

CPENameOperatorVersion
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginlt5.1.6
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginge6.0.0
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/loginlt6.1.0

Name	Operator	Version
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	lt	5.1.6
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	ge	6.0.0
go/github.com/apache/trafficcontrol/traffic_ops/traffic_ops_golang/login	lt	6.1.0