CVE-2019-17567

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-444

Affected software

VendorProductVersions
Apache Software FoundationApache HTTP Server2.4.46; 2.4.43; 2.4.41; 2.4.39; 2.4.38; 2.4.37; 2.4.35; 2.4.34; 2.4.33; 2.4.29; 2.4.28; 2.4.27; 2.4.26; 2.4.25; 2.4.23; 2.4.20; 2.4.18; 2.4.17; 2.4.16; 2.4.12

References

Timeline

Published
Jun 10, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-175694.8The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the CVE-2019-17575.9A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gaiCVE-2019-175709.8An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpCVE-2019-175719.8Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeCVE-2019-175725.3In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../CVE-2019-175736.1By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerabCVE-2019-175749.1An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the argumenCVE-2019-175757.2A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user wCVE-2019-175765.4An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via thCVE-2019-175775.4An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via theCVE-2019-175785.4An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via theCVE-2019-175796.1SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
CVE-2019-17567: Medium severity, CVSS 5.3 | Vulnix