CVE-2024-45387: SQL injection in Apache Traffic Control

December 23, 2024 (updated February 11, 2025)

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role “admin”, “federation”, “operations”, “portal”, or “steering” to execute arbitrary SQL against the database by sending a specially-crafted PUT request.

Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

References

github.com/advisories/GHSA-vq94-9pfv-ccqr
github.com/apache/trafficcontrol
github.com/apache/trafficcontrol/releases/tag/v8.0.2
lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr
nvd.nist.gov/vuln/detail/CVE-2024-45387

Code Behaviors & Features

Detect and mitigate CVE-2024-45387 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →