PT-2017-5879 · Apache · Apache Traffic Server

Leif Hedstrom

·

CVE-2014-3624

·

Published

2017-10-30

·

Updated

2017-11-17

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Apache Traffic Server version 5.1.x before 5.1.1
Description: The issue allows remote attackers to bypass access restrictions by leveraging the failure to properly tunnel remap requests using the CONNECT method.
Recommendations: For Apache Traffic Server version 5.1.x before 5.1.1, update to version 5.1.1 or later to resolve the issue.

Fix

Improper Access Control

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2014-3624

Affected Products

Apache Traffic Server