CVE-2017-15715 Information
Share on:Description
In Apache httpd 2.4.0 to 2.4.29 the expression specified in FilesMatch could match ‘$’ to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked but only by matching the trailing portion of the filename.
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Reference
http://www.openwall.com/lists/oss-security/2018/03/24/6 http://www.securityfocus.com/bid/103525 http://www.securitytracker.com/id/1040570 https://access.redhat.com/errata/RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2019:0366 https://access.redhat.com/errata/RHSA-2019:0367 https://httpd.apache.org/security/vulnerabilities_24.html https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@3Ccvs.httpd.apache.org3E https://security.elarlang.eu/cve-2017-15715-apache-http-server-filesmatch-bypass-with-a-trailing-newline-at-the-end-of-the-file-name.html https://security.netapp.com/advisory/ntap-20180601-0004/ https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us https://usn.ubuntu.com/3627-1/ https://usn.ubuntu.com/3627-2/ https://www.debian.org/security/2018/dsa-4164 https://www.tenable.com/security/tns-2019-09
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
HIGH
Base Severity
8.1