b2b-daily
Home | IT | Cyber Security

Critical SQL Injection Flaw Patched in Apache Traffic Control Update

Avatar photo
by Tailor Jackson
December 26, 2024
Critical SQL Injection Flaw Patched in Apache Traffic Control Update

In a significant effort to address a critical security flaw, the Apache Software Foundation (ASF) has released a patch for a vulnerability in Apache Traffic Control, an open-source Content Delivery Network (CDN) project. This vulnerability, identified as CVE-2024-45387, has been assigned an alarming severity score of 9.9 out of 10 on the Common Vulnerability Scoring System (CVSS). The flaw allows a privileged user with roles such as ‘admin,’ ‘federation,’ ‘operations,’ ‘portal,’ or ‘steering’ to execute arbitrary SQL commands in the database through a specially crafted PUT request. The discovery was made by Yuan Luo from Tencent YunDing Security Lab, prompting a response from ASF to mitigate the risk.

In response to the identified threat, ASF promptly issued a patch included in the updated version 8.0.2 of Apache Traffic Control. The swift action was crucial to secure the framework against potential malicious exploitation. The nature of the flaw enables those with specific roles more control than intended, compromising the database’s integrity. Such a severe vulnerability underscores the importance of maintaining updated software systems and vigilant security practices within organizations relying on Apache Traffic Control for their content delivery needs. The update to version 8.0.2 is strongly advised for all users to safeguard their systems effectively.

Alongside the fix for Apache Traffic Control, ASF has recently addressed other critical security issues within its ecosystem. This includes an authentication bypass flaw in Apache HugeGraph-Server, identified as CVE-2024-43441 and resolved in version 1.5.0. Additionally, a remote code execution vulnerability found in Apache Tomcat, CVE-2024-56337, has been rectified. These updates reflect ASF’s ongoing commitment to enhancing the security and resilience of its software offerings.

Users are urged to swiftly upgrade their Apache Traffic Control installations to the latest version 8.0.2, ensure Apache HugeGraph-Server is updated to version 1.5.0, and verify their Apache Tomcat installations are current. The persistent emergence of security vulnerabilities highlights the necessity for continuous vigilance and timely software updates to protect against evolving cybersecurity threats. Proactive measures and attention to security advisories are essential in maintaining robust defenses against potential exploits.

Information Security

Explore more

Will Ethereum Hold as ICO Whales and Founders Cash Out?
October 6, 2026

When an original ICO whale deposits $36.37 million into a centralized exchange after a nine-year dormancy, the broader market must weigh the impact of sudden sell-side pressure. As the digital asset landscape navigates this influx of liquidity, Ethereum continues to maintain a critical defensive perimeter above the $2,700 mark, displaying an unexpected level of resilience. Despite the potential for a

Is Argentina Facing a National Cybersecurity Crisis?
October 6, 2026

Argentina has emerged as a primary target for international cybercriminals, now ranking as the third or fourth most attacked nation in Latin America behind Brazil and Mexico. This development is not merely a statistical anomaly but represents a fundamental shift in the regional threat landscape, where the country is currently enduring what experts describe as a persistent digital siege. According

Apple to Toughen Mac Privacy Controls for Full Disk Access
October 6, 2026

The tension between the functionality of backup software and the privacy of communication apps is at the heart of Apple’s decision to toughen its Full Disk Access controls. This significant policy shift, announced on October 2, 2026, marks a pivotal moment for macOS as it grapples with the encroaching capabilities of autonomous artificial intelligence. Full Disk Access has long been

What Does Windows 11 26H2 Mean for Your Hardware?
October 6, 2026

The deployment of the 26## update utilizes an enablement package that acts as a master switch to activate features already present on the system drive. Launched officially on September 29, this iteration, widely recognized as the Windows 11 2026 Update, represents a defining moment for the platform as it solidifies its third and final release built upon the Germanium core

ClickFix Attack Uses Browser Cache to Bypass Windows Limits
October 6, 2026

Threat actors are bypassing the 260-character restriction of the Windows Run dialog by smuggling script payloads into local browser profile folders as cached PNG data. This innovative technique represents a significant departure from standard malware delivery because it leverages the inherent trust users place in their local web environments to stage malicious code before any visible interaction occurs. By exploiting