CVE-2021-43350— LDAP filter injection vulnerability in Traffic Ops
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-43350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LDAP filter injection vulnerability in Traffic Ops
Source: NVD (National Vulnerability Database)
Vulnerability Description
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Traffic Control 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Traffic Control是美国阿帕奇（Apache）基金会的一套分布式、可扩展的内容分发解决方案。该产品主要用于构建大规模内容分发网络。 Apache Traffic Control Traffic Ops 存在安全漏洞，远程攻击者可以将未经处理的内容注入LDAP过滤器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Traffic Control | Traffic Ops ~ 6.0.1 | - |
II. Public POCs for CVE-2021-43350
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-43350
请登录查看更多情报信息。
- https://trafficcontrol.apache.org/security/x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2021-43350
IV. Related Vulnerabilities
Same product: Apache Traffic Control
- CVE-2025-61581
Apache Traffic Control: ReDoS issue in Traffic Router config - CVE-2024-45387
Apache Traffic Control: SQL Injection in Traffic Ops endpoin - CVE-2022-23206
Server-Side Request Forgery in Traffic Ops endpoint POST /us - CVE-2021-42009
Apache Traffic Control Traffic Ops Email Injection Vulnerabi - CVE-2020-17522
Apache Traffic Control 安全漏洞
Same vendor: Apache Software Foundation
- CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro - CVE-2026-25077
Apache CloudStack: Unauthenticated Command Injection in Dire - CVE-2025-69233
Apache CloudStack: Domain/account resources limits not honor - CVE-2025-66467
Apache CloudStack: MinIO policy remains intact on bucket del
Same weakness: CWE-90
- CVE-2026-40606
ProxyAuth Addon LDAP Injection in mitmproxy - CVE-2026-40459
LDAP Injection in PAC4J - CVE-2026-40193
Maddy Mail Server: LDAP Filter Injection via Unsanitized Use - CVE-2026-0636
LDAP Injection Vulnerability in LDAPStoreHelper.java - CVE-2026-39962
LDAP injection in MISP ApacheAuthenticate when using a user-
V. Comments for CVE-2021-43350
No comments yet