CVE-2021-42009CWE-20

Apache Traffic Control Traffic Ops Email Injection Vulnerability

published October 12, 2021

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02824 · 86.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-10-12T07:40Z
EPSS history
Timeline
  • 12 OCT 07:40Z
    Apache Traffic Control Traffic Ops Email Injection Vulnerability
    cvelistv5