CVE-2020-17522 Cache Manipulation Attack in Apache Traffic Control

What is CVE-2020-17522?

CVE-2020-17522 is a medium-severity missing authorization vulnerability in Apache Traffic Control, published on 26 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.

Weakness: CWE-732

Which versions are affected by CVE-2020-17522?

2 open source packages ship an affected version, including github.com/apache/trafficcontrol. It affects 1 product.

Products include Apache Traffic Control.

How do I fix CVE-2020-17522?

Upgrade github.com/apache/trafficcontrol to 5.0.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-17522 being exploited?

There is no known exploitation of CVE-2020-17522 in the wild and no public exploit code.

Other vulnerabilities in Apache Traffic Control

• CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments Critical 9.9
• CVE-2021-43350 LDAP filter injection vulnerability in Traffic Ops Critical 9.8
• CVE-2019-12405 Improper Authentication in Apache Traffic Control Critical 9.8
• CVE-2025-61581 Apache Traffic Control: ReDoS issue in Traffic Router configuration High 7.5
• CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pw59-4qgf-jxr8.