« Volver al listado

CVE-2022-23206

Estado: ModificadaAlta (7.5)—

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Traffic Control

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23206",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Traffic Control",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "5.1.6",
                  "status": "unaffected"
                }
              ],
              "version": "Traffic Ops",
              "lessThan": "6.1.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-06T16:15:07.593",
  "references": [
    {
      "url": "https://lists.apache.org/thread/lsrd2mqj29vrvwsh8g0d560vvz8n126f",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/lsrd2mqj29vrvwsh8g0d560vvz8n126f",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach."
    },
    {
      "lang": "es",
      "value": "En Apache Traffic Control Traffic Ops versiones anteriores a 6.1.0 o 5.1.6, un usuario no privilegiado que puede llegar a Traffic Ops a través de HTTPS puede enviar una petición POST especialmente diseñada a /user/login/oauth para escanear un puerto de un servidor al que Traffic Ops puede llegar"
    }
  ],
  "lastModified": "2026-06-17T04:29:41.063",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2831474-61B4-4F7F-91BC-520068D6BBFF",
              "versionEndExcluding": "5.1.6"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64893710-A989-44B6-BEC6-A49B5287ACEE",
              "versionEndExcluding": "6.1.0",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}