cve.bz

CVE-2020-17522

5.8 mediumEPSS 4.0%

Medium (5.8) in apache traffic control. EPSS 4.0% chance of exploitation in the next 30 days. Fixed in github.com/apache/trafficcontrol 5.0.0.

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.

Severity

CVSS 3.1

5.8 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS
4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE
CWE-732
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-pw59-4qgf-jxr8Gogithub.com/apache/trafficcontrol<5.0.05.0.0

References

Check your stackJSON