CVE-2022-23206: Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-06 · updated 2026-06-17
Weakness: CWE-918

Description

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.

Affected products

Apache Software Foundation Apache Traffic Control: before 5.1.6; from 6.0.0 before 6.1.0 — fixed in 5.1.6, 6.1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Traffic Control 5.1.6, 6.1.0. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/lsrd2mqj29vrvwsh8g0d560vvz8n126f
https://lists.apache.org/thread/lsrd2mqj29vrvwsh8g0d560vvz8n126f

Get alerted when CVE-2022-23206 or the next vulnerability affects your stack