CVE-2024-45387

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request.

Users are recommended to upgrade to version Apache Traffic Control 8.0.2 if you run an affected version of Traffic Ops.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Dec 23, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-453887.5Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POSCVE-2024-453895.4Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first scriCVE-2024-45396.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5CVE-2024-453909.8@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if theCVE-2024-453917.5Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 tCVE-2024-453924.3SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control cheCVE-2024-453936.4Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT accounCVE-2024-453947.8Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data CVE-2024-453957.5sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 wheCVE-2024-453967.5Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attackerCVE-2024-453977.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open orCVE-2024-453988.8Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute th
CVE-2024-45387: High severity, CVSS 8.8 | Vulnix