GitHub Advisoryadvisory · PyPI

GHSA-22jh-6gx8-f944 Elastic APM agent for Python client CGI proxy redirection flaw

MEDIUM Published 2022-05-24 Modified 2024-09-20 Official page ↗
Aliases
CVE-2019-7617
Ecosystem
PyPI
Packages
elastic-apm
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-20
Reviewed
2023-07-17

Affected packages

• PyPI elastic-apm: < 5.1.0 → fixed in 5.1.0

Description

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.

Related

Alias · CVE (1)

  • CVE-2019-7617 When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References