In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
                
            Metrics
Affected Vendors & Products
Advisories
    | Source | ID | Title | 
|---|---|---|
|  Debian DSA | DSA-4164-1 | apache2 security update | 
|  Ubuntu USN | USN-3627-1 | Apache HTTP Server vulnerabilities | 
|  Ubuntu USN | USN-3627-2 | Apache HTTP Server vulnerabilities | 
Fixes
    Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
        History
                    No history.
 MITRE
                        MITRE
                    Status: PUBLISHED
Assigner: apache
Published:
Updated: 2024-09-17T02:21:04.135Z
Reserved: 2017-10-21T00:00:00
Link: CVE-2017-15715
 Vulnrichment
                        Vulnrichment
                    No data.
 NVD
                        NVD
                    Status : Modified
Published: 2018-03-26T15:29:00.287
Modified: 2024-11-21T03:15:04.313
Link: CVE-2017-15715
 Redhat
                        Redhat
                     OpenCVE Enrichment
                        OpenCVE Enrichment
                    No data.