CVE-2021-42009

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.

• CWE-20
• CWE-20

• http://www.openwall.com/lists/oss-security/2021/10/12/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb%40%3Cdev.trafficcontrol.apache.org%3E
• https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927c1533d06d702af%40%3Cdev.trafficcontrol.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3EMailing List, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2021/10/12/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb%40%3Cdev.trafficcontrol.apache.org%3E
• https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927c1533d06d702af%40%3Cdev.trafficcontrol.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3EMailing List, Patch, Vendor Advisory

Published

Oct 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4200A Improper Privilege Management vulnerability in SUSE Ranche…5.4
• CVE-2021-42000When a password reset or password change flow with an authen…6.5
• CVE-2021-42001PingID Desktop prior to 1.7.3 has a misconfiguration in the …9.9
• CVE-2021-42002Zoho ManageEngine ADManager Plus before 7115 is vulnerable t…9.8
• CVE-2021-42006An out-of-bounds access in GffLine::GffLine in gff.cpp in GC…8.8
• CVE-2021-42008The decode_data function in drivers/net/hamradio/6pack.c in …7.8
• CVE-2021-4201Missing access control in ForgeRock Access Management 7.1.0 …9.8
• CVE-2021-42010Heron versions <= 0.20.4-incubating allows CRLF log injectio…9.8
• CVE-2021-42011An incorrect permission assignment vulnerability in Trend Mi…7.8
• CVE-2021-42012A stack-based buffer overflow vulnerability in Trend Micro A…7.8
• CVE-2021-42013It was found that the fix for CVE-2021-41773 in Apache HTTP …9.8
• CVE-2021-42015A vulnerability has been identified in Mendix Applications u…5.5