{"id":"CVE-2017-15715","published":"2018-03-26T15:00:00Z","modified":"2024-09-17T02:21:04Z","title":"In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a…","vendor":"Apache Software Foundation","product":"Apache HTTP Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","versions":["2.4.0 to 2.4.29"]}],"description":{"text":"In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in Apache HTTP Server (Apache Software Foundation) versions 2.4.0 through 2.4.29, where the expression in a <FilesMatch> directive can match \"$\" against a newline character inside a filename instead of only the true end of the filename. An attacker can exploit this where uploads of certain file types are blocked externally, by submitting a malicious filename whose trailing portion matches the restricted pattern, which requires the server to rely on <FilesMatch> rules for that filtering.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:49Z"},"cvss":null,"epss":{"score":0.85452,"percentile":0.9972,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-02-22","exploitedFirstSeen":"2022-02-22","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html","date":"2022-02-22"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"smtech.hr  - 194.135.80.88 - #FANOS -   vuln to 24 CVE's","url":"https://otx.alienvault.com/pulse/6285ac654db92004b788b4ae","created":"2022-05-19"},{"name":"SMS Phisphing Campaign","url":"https://otx.alienvault.com/pulse/62826e6e99e1c6ccf06b100e","created":"2022-05-16"},{"name":"103.224.212.227 - cve-2019-0220 cdn/supplychain","url":"https://otx.alienvault.com/pulse/625d4ab4eb07779bf6221298","created":"2022-04-18"},{"name":"Internal CVE Research","url":"https://otx.alienvault.com/pulse/6228b4f0b2d5ade72cc7a0ea","created":"2022-03-09"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://usn.ubuntu.com/3627-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://www.debian.org/security/2018/dsa-4164","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://security.netapp.com/advisory/ntap-20180601-0004/","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3558","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0367","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://usn.ubuntu.com/3627-2/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/bid/103525","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1040570","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2018/03/24/6","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0366","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.elarlang.eu/cve-2017-15715-apache-http-server-filesmatch-bypass-with-a-trailing-newline-at-the-end-of-the-file-name.html","tags":["x_refsource_MISC"]},{"url":"https://www.tenable.com/security/tns-2019-09","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-7142","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7142","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2026-07-09","earliestUrl":"https://github.com/ehsehs5652/CVE-2017-15715-httpd","repos":[{"name":"ehsehs5652/CVE-2017-15715-httpd","url":"https://github.com/ehsehs5652/CVE-2017-15715-httpd","stars":0,"created":"2026-07-09"},{"name":"CyberCTF/vulhub-httpd-cve-2017-15715","url":"https://github.com/CyberCTF/vulhub-httpd-cve-2017-15715","stars":0,"created":"2026-10-08"}]},"nuclei":[{"id":"CVE-2017-15715","name":"Apache httpd <=2.4.29 - Arbitrary File Upload","severity":"high","path":"http/cves/2017/CVE-2017-15715.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15715.yaml"}],"first":{"date":"2026-07-09","source":"PoC-in-GitHub","url":"https://github.com/ehsehs5652/CVE-2017-15715-httpd"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2018-03-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-15715","provenance":"source"},{"date":"2022-02-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html","provenance":"source"},{"date":"2026-07-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ehsehs5652/CVE-2017-15715-httpd","provenance":"source"}],"speed":{"daysToPublicExploit":3027,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":61.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1710 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9972"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}