CVE-2022-23206
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
| Software | From | Fixed in |
|---|---|---|
| apache / traffic_control | 6.0.0 | 6.1.0 |
| apache / traffic_control | - | 5.1.6 |
github.com/apache/trafficcontrol
|
6.0.0 | 6.1.0 |
|
github.com/apache/trafficcontrol
|
- | 5.1.6 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime