GHSA-wp47-9r3h-xfgq
Server-Side Request Forgery in Apache Traffic Control
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/apache/trafficcontrol | >= 6.0.0, < 6.1.0 | 6.1.0 |
| Go | github.com/apache/trafficcontrol | < 5.1.6 | 5.1.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
References
External links from the advisory. They lead to third-party sites.