CVE-2021-42009

published 2021-10-12

CVE-2021-42009: An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the…

Priority P4 30 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I L A N

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	traffic_control	>= 4.1.0 < 5.1.3	5.1.3
apache_software_foundation	apache_traffic_control	>= 4.0.0 < Apache Traffic Control*	Apache Traffic Control*
github.com	apache_trafficcontrol	>= 0 < 5.1.3+incompatible	5.1.3+incompatible
github.com	apache_trafficcontrol	>= 0 < 5.1.3	5.1.3

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20