CVE-2024-38479CWE-20

Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack

High · published November 14, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.

Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00823 · 56.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-11-14T09:52Z
EPSS history
Timeline
  • 14 NOV 09:52Z
    Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
    cvelistv5