CVE-2024-45387
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 41.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 41.54% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89, CWE-285
- Affected
- apache/traffic control
- Source
- security@apache.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.