CVE-2020-17522: Cache Manipulation Attack in Apache Traffic Control
Summary
CVE-2020-17522: Cache Manipulation Attack in Apache Traffic Control. Affects github.com/apache/trafficcontrol versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Traffic Control is an open-source content delivery network (CDN) management tool written in Go. It is designed to help organizations manage and optimize the delivery of their web content. The tool generates ip_allow.config files, which control access permissions for CDN cache servers. These files are used to define the IP addresses that are allowed to push and remove content from the cache. However, a vulnerability in versions 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0 of Apache Traffic Control allows bad actors to manipulate these files and potentially grant permissions to IP addresses outside the desired range, compromising the security and integrity of the CDN architecture.
Vulnerability Detail
The vulnerability (CVE-2020-17522) in Apache Traffic Control allows attackers to push arbitrary content into and remove arbitrary content from CDN cache servers. By exploiting this vulnerability, bad actors can bypass the intended access restrictions and potentially gain control over the cache servers. This can lead to unauthorized access to sensitive content, data leakage, and disruption of the CDN service. The vulnerability has a CVSS score of 5.8, indicating a moderate severity level.
How To Fix
Latest published version: v7.0.1+incompatible as of 23 Oct 2026
go get github.com/apache/trafficcontrol@v7.0.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
go get github.com/apache/trafficcontrol@v5.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Apache Traffic Control version 5.0.0 or later.
Conclusion
The Cache Manipulation Attack vulnerability in Apache Traffic Control can be mitigated by upgrading to version 5.0.0 or later. This will ensure that permissions for CDN cache servers are correctly enforced and restricted to the desired IP address range. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/apache/trafficcontrol →
FAQ
Apache Traffic Control is an open-source content delivery network (CDN) management tool.
The vulnerability allows attackers to manipulate CDN cache servers and potentially gain unauthorized access to sensitive content.
Versions 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0 of Apache Traffic Control are affected.
Upgrade to Apache Traffic Control version 5.0.0 or later to fix this vulnerability.
No, there is no known workaround. Upgrading to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/trafficcontrol.
