Incorrect permission assignment in Apache Traffic Control
Priority LOW 33CWE-732Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
Why it matters now
EPSS 0.03976 90th percentileScored 2026-11-07
Fix Fixed github.com/apache/trafficcontrol (Go): 5.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Traffic Control | Traffic Control 3.0.0 to 3.1.0, 4.0.0 to 4.1.0 | — | No fix listed | CNA |
| — | github.com/apache/trafficcontrol (Go) | before 5.0.0 | 5.0.0 | Patch available | GHSA-pw59-4qgf-jxr8 |
- Apache Traffic Control Vendor— Affected Traffic Control 3.0.0 to 3.1.0, 4.0.0 to 4.1.0 Fixed in — No fix listed CNA
- github.com/apache/trafficcontrol (Go) Vendor— Affected before 5.0.0 Fixed in 5.0.0 Patch available GHSA-pw59-4qgf-jxr8
Remediation
- Fix · GHSA-pw59-4qgf-jxr8 github.com/apache/trafficcontrol (Go) Fixed in 5.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-17522
- 2026-10-03 Alias added: GHSA-pw59-4qgf-jxr8
References
Advisory 2
Other 6
- [trafficcontrol-commits] 20210616 [trafficcontrol-website] branch asf-site updated: Fix CVE-2020-17522 link
- [trafficcontrol-commits] 20211011 [trafficcontrol-website] 01/02: Add CVE-2021-42009
- https://github.com/apache/trafficcontrol/commit/492290d810e9608afb5d265b98cd3f3e153e776b
- https://github.com/apache/trafficcontrol
- https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8@%3Ccommits.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf@%3Ccommits.trafficcontrol.apache.org%3E
More Apache Traffic Control vulnerabilities
- TI-2024-30436 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments CVSS 3.1CRITICAL 9.9
- TI-2021-19325 LDAP filter injection vulnerability in Traffic Ops CVSS 3.1CRITICAL 9.8
- TI-2019-09251 Improper authentication in Apache Traffic Control CVSS 3.1CRITICAL 9.8
- TI-2025-38028 Apache Traffic Control: ReDoS issue in Traffic Router configuration CVSS 3.1HIGH 7.5
- TI-2017-05306 Uncontrolled resource consumption in Apache Traffic Control CVSS 3.0HIGH 7.5
- TI-2022-07358 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth CVSS 3.1HIGH 7.5
Sources
- CVE-2020-17522 · CVE Program
- CVE-2020-17522 · NVD
- FIRST EPSS
- GHSA-pw59-4qgf-jxr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences