CVE-2021-43350

CVE-2021-43350: LDAP filter injection vulnerability in Traffic Ops

Vendor Apache Software Foundation

Product Apache Traffic Control

Weakness CWE-90 · LDAP injection

Published November 11, 2021

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

Key dates

02Disclosure timeline

November 11, 2021 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-43350 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/90.html

Related vulnerabilities

04Related CVE

CVE-2026-39962 LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable CVE-2019-11277 Volume Services is vulnerable to an LDAP injection attack CVE-2026-31828 Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction CVE-2026-46745 Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token CVE-2023-3447 Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection