CVE-2019-7617

{"id": "CVE-2019-7617", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "published": "2019-08-22T17:15:10.357", "references": [{"url": "https://discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}, {"url": "https://www.elastic.co/community/security/", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing."}, {"lang": "es", "value": "Cuando el agente Elastic APM para Python versiones anteriores a 5.1.0 es ejecutado como un script de CGI, se presenta un fallo de choque de nombre de variable si un atacante remoto puede controlar el encabezado proxy. Esto podr\u00eda resultar en que un atacante redireccione los datos de APM recopilados para un proxy de su elecci\u00f3n."}], "lastModified": "2019-10-09T23:52:08.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "62AE9978-3389-4D33-B805-34E99270797E", "versionEndExcluding": "5.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}