Low severity · published Jan 8, 2016
CVE-2015-7519
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering…
3.7
CVSS
2.4%
EPSS
No
On KEV
Description
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Phusion Passenger · Phusionpassenger
through 4.0.59; 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7519
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00024.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/12/07/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/12/07/2
Vendor Advisory
https://blog.phusion.nl/2015/12/07/cve-2015-7519/
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=956281
github.com
https://github.com/phusion/passenger/commit/ddb8ecc4ebf260e4967f57f271d4f5761abeac3e