CVE-2019-7617CWE-20

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the…

published August 22, 2019

CVSS
—
EPSS
2%
Percentile
74.2
In the wild
Unconfirmed
What it is

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01510 · 74.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2019-08-22T16:12Z
EPSS history
Timeline
  • 22 AUG 16:12Z
    When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the…
    cvelistv5