CVE-2015-7519

LOW

Phusion Passenger <4.0.60, 5.0.x <5.0.22 - Header Spoofing

Title source: llm
STIX 2.1

Description

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.

References (8)

Core 8
Core References
Vendor Advisory x_refsource_confirm
https://blog.phusion.nl/2015/12/07/cve-2015-7519/
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/07/2
Issue Tracking x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=956281
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/07/1
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html

Scores

CVSS v3 3.7
EPSS 0.0036
EPSS Percentile 58.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-20
Status published
Products (24)
phusionpassenger/phusion_passenger 5.0.0 (6 CPE variants)
phusionpassenger/phusion_passenger 5.0.1
phusionpassenger/phusion_passenger 5.0.2
phusionpassenger/phusion_passenger 5.0.3
phusionpassenger/phusion_passenger 5.0.4
phusionpassenger/phusion_passenger 5.0.5
phusionpassenger/phusion_passenger 5.0.6
phusionpassenger/phusion_passenger 5.0.7
phusionpassenger/phusion_passenger 5.0.8
phusionpassenger/phusion_passenger 5.0.9
... and 14 more
Published Jan 08, 2016
Tracked Since Feb 18, 2026