CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-45387
High (8.8) in apache traffic control. EPSS 65% chance of exploitation in the next 30 days. Fixed in github.com/apache/trafficcontrol/v8 8.0.2.
An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request.
Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.
Severity
- EPSS
- 65% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-89, CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:traffic_control
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vq94-9pfv-ccqr | Go | github.com/apache/trafficcontrol/v8 | >=8.0.0 <8.0.2 | 8.0.2 |
| GO-2024-3358 | Go | github.com/apache/trafficcontrol | all versions | no fix published |
| GO-2024-3358 | Go | github.com/apache/trafficcontrol/v8 | >=8.0.0 <8.0.2 | 8.0.2 |