CVE-2019-7617
Elastic APM agent for Python client CGI proxy redirection flaw
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
CVE-2019-7617- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
CVE-2019-7617- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2019-0048 No score
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
EUVD-2019-0048- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-22jh-6gx8-f944
Elastic APM agent for Python client CGI proxy redirection flaw
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
GHSA-22jh-6gx8-f944- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
CVE-2019-7617- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-22jh-6gx8-f944
Elastic APM agent for Python client CGI proxy redirection flaw
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
GHSA-22jh-6gx8-f944- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2019-178 No score
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
- Record
PYSEC-2019-178- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
elastic-apmPyPI |
before 5.1.0 | 5.1.0 |
elastic-apmPyPI |
before 5.1.0, plus listed versions 1.0.01.0.0.dev01.0.0.dev11.0.0.dev21.0.0.dev3 Show 21 moreShow less2.0.02.0.12.1.02.1.12.2.02.2.13.0.03.0.13.0.23.0.33.0.43.0.54.0.04.0.14.0.24.0.34.1.04.2.04.2.14.2.25.0.0 |
5.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7617 is a high vulnerability (CVSS 7.2) in Elastic Apm Agent, published August 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in elastic-apm 5.1.0.
References
elastic.co/community/security
discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145
nvd.nist.gov/vuln/detail/CVE-2019-7617
github.com/pypa/advisory-database/tree/main/vulns/elastic-apm/PYSEC-2019-178.yaml