title: LDAP filter injection vulnerability in Traffic Ops
description: An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
problem types: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
affected:
{
product: Apache Traffic Control
vendor: Apache Software Foundation
versions:
changes: [at: 5.1.4, status: unaffected], lessThan: 6.0.1, status: affected, version: Traffic Ops, versionType: custom
}
metrics:
other: [
content: {'other': 'critical'}
type: unknown
]