CVE-2024-38479

CWE-20 — Improper Input Validation5 documents5 sources

Severity

7.5HIGH

EPSS

0.6%

top 31.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Traffic Server Apache Software Foundation Apache Traffic Server

Timeline

PublishedNov 14

Description

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/traffic_server9.0.0 — 9.2.6+1

▶CVEListV5apache_software_foundation/apache_traffic_server8.0.0 — 8.1.11+1

▶Debiantrafficserver< 8.1.11+ds-0+deb11u2+1

🔴Vulnerability Details

OSV

CVE-2024-38479: Improper Input Validation vulnerability in Apache Traffic Server↗2024-11-14

▶

CVEList

Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack↗2024-11-14

▶

GHSA

GHSA-c43q-432c-pfx8: Improper Input Validation vulnerability in Apache Traffic Server↗2024-11-14

▶

📋Vendor Advisories

Debian

CVE-2024-38479: trafficserver - Improper Input Validation vulnerability in Apache Traffic Server. This issue af...↗2024

▶