Search for vulnerabilities
Vulnerability details: VCID-dn7e-xgnt-sbcm
Vulnerability ID VCID-dn7e-xgnt-sbcm
Aliases CVE-2025-31698
Summary ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol.  This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-284 Improper Access Control
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31698.json
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2025-31698
cvssv3.1 7.5 https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
ssvc Track https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31698.json
https://api.first.org/data/v1/epss?cve=CVE-2025-31698
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31698
1108044 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108044
15t32nxbypqg1m2smp640vjx89o6v5f8 https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
2373846 https://bugzilla.redhat.com/show_bug.cgi?id=2373846
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
CVE-2025-31698 https://nvd.nist.gov/vuln/detail/CVE-2025-31698
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31698.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-20T13:31:33Z/ Found at https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
Exploit Prediction Scoring System (EPSS)
Percentile 0.24642
EPSS Score 0.00082
Published At Aug. 11, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:21:46.228757+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/31xxx/CVE-2025-31698.json 37.0.0