PT-2026-120789 · Apache · Apache Traffic Server
CVSS v3.1
10
حرجة
| المتجه | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
Apache Traffic Server's origin server auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
إصلاح
Incorrect Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Apache Traffic Server