CVE-2017-15715
HIGH 8.1EPSS 85.5%
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
- Affected
- Apache Software Foundation · Apache HTTP Server
- CVSS v3.0 NVD
- 8.1 HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P - EPSS
- 85.45% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- high · CWE-20
- Published
- 2018-03-26
- Updated
- 2024-09-17
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (1)
- （CVE-2017-15715）Apache解析漏洞helloexp/0day
Security advisories
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://www.openwall.com/lists/oss-security/2018/03/24/6
- http://www.securityfocus.com/bid/103525
- http://www.securitytracker.com/id/1040570
- https://access.redhat.com/errata/RHSA-2018:3558
- https://access.redhat.com/errata/RHSA-2019:0366
- https://access.redhat.com/errata/RHSA-2019:0367
- https://security.netapp.com/advisory/ntap-20180601-0004
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909…
- https://usn.ubuntu.com/3627-1
- https://usn.ubuntu.com/3627-2
- https://www.debian.org/security/2018/dsa-4164