未評価
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
CVE-2022-23206
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web lists.apache.org