CVE-2019-7617

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-22 · updated 2026-06-17
Weakness: CWE-20

Description

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.

Affected products

Elastic APM agent for Python: before 5.1.0 — fixed in 5.1.0

How to fix

Upgrade to a fixed version: Elastic APM agent for Python 5.1.0. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145
https://www.elastic.co/community/security/
https://discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145
https://www.elastic.co/community/security/

Get alerted when CVE-2019-7617 or the next vulnerability affects your stack