Vulnerability Description
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Traffic Control | >= 4.1.0, < 5.1.3 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2021/10/12/1Mailing ListThird Party Advisory
- https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c3
- https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6c
- https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927Mailing ListVendor Advisory
- https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e35555Mailing ListPatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2021/10/12/1Mailing ListThird Party Advisory
- https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c3
- https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6c
- https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927Mailing ListVendor Advisory
- https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e35555Mailing ListPatchVendor Advisory
FAQ
What is CVE-2021-42009?
CVE-2021-42009 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to...
How severe is CVE-2021-42009?
CVE-2021-42009 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-42009?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Traffic Control.