Skip to content
OpenAdvisories
Critical · 9.8 CVE-2019-12405 EUVD-2021-0918GHSA-3f8r-4qwm-r7jf

Improper Authentication in Apache Traffic Control

Published Sep 9, 2019 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Product: Traffic Control Package: github.com/apache/trafficcontrol Ecosystem: Go

Description

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.

Affected products

VendorProductAffectedFixed
Apache Traffic Control 3.0.0 and 3.0.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/apache/trafficcontrol >= 3.0.0, < 3.0.2-RC1 3.0.2-RC1 GHSA-3f8r-4qwm-r7jf

References