CVE-2022-23206: Server-Side Request Forgery (SSRF)

February 7, 2022 (updated February 15, 2022)

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.

References

github.com/advisories/GHSA-wp47-9r3h-xfgq
lists.apache.org/thread/lsrd2mqj29vrvwsh8g0d560vvz8n126f
nvd.nist.gov/vuln/detail/CVE-2022-23206

Code Behaviors & Features

Detect and mitigate CVE-2022-23206 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →