UpHeron
All vulnerabilities

Servers and applications

CVE-2017-15715

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.

Severity
High 8.1
Published
26 Mar 2018
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.4.0 up to 2.4.29

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-15715
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-15715