VULNERABILITY INTELLIGENCE

CVE-2019-7617

CVSS score7.2 HIGH
EPSS probability1.51%
CISA KEVNot currently listed
Published2019-08-22
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.

Weakness classification

  • security@elastic.co: CWE-20
  • nvd@nist.gov: CWE-20

Primary references