CVE-2019-12405

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
ApacheTraffic Control3.0.0 and 3.0.1

References

Timeline

Published
Sep 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-124066.5Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possCVE-2019-124076.1On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,CVE-2019-124087.5It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had CVE-2019-124099.8The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default sCVE-2019-12417.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnCVE-2019-124107.5While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, leftCVE-2019-124127.5A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could senCVE-2019-124135.3In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specCVE-2019-124145.3In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLabCVE-2019-124155.5In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted documCVE-2019-124166.1we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWiCVE-2019-124174.8A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view
CVE-2019-12405: Critical severity, CVSS 9.8 | Vulnix