CVE-2017-15715
HIGH EXPLOITED IN THE WILD NUCLEIApache httpd <=2.4.29 - Arbitrary File Upload
Title source: nucleiDescription
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
Exploits (1)
Nuclei Templates (1)
Apache httpd <=2.4.29 - Arbitrary File Upload
HIGHby geeknik
Shodan:
cpe:"cpe:2.3:a:apache:http_server" || apache 2.4.49
References (27)
... and 7 more
Scores
CVSS v3
8.1
EPSS
0.9410
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2022-02-22
InTheWild.io
2022-02-22
CWE
CWE-20
Status
published
Products (16)
apache/http_server
2.4.0 - 2.4.29
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
17.10
canonical/ubuntu_linux
18.04
debian/debian_linux
8.0
debian/debian_linux
9.0
netapp/clustered_data_ontap
netapp/santricity_cloud_connector
netapp/storage_automation_store
... and 6 more
Published
Mar 26, 2018
Tracked Since
Feb 18, 2026