CVE-2015-7519

Published: Jan 8, 2016Modified: May 6, 2026

3.7

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.

Affected (28)

Products: Phusionpassenger: Phusion Passenger

Phusionpassenger

1 product

Phusion Passenger

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Phusionpassenger Phusion Passenger	Up to 4.0.59
Phusionpassenger Phusion Passenger	Version 5.0.0
Phusionpassenger Phusion Passenger	Version 5.0.0 beta1
Phusionpassenger Phusion Passenger	Version 5.0.0 beta2
Phusionpassenger Phusion Passenger	Version 5.0.0 beta3
Phusionpassenger Phusion Passenger	Version 5.0.0 rc1
Phusionpassenger Phusion Passenger	Version 5.0.0 rc2
Phusionpassenger Phusion Passenger	Version 5.0.10
Phusionpassenger Phusion Passenger	Version 5.0.11
Phusionpassenger Phusion Passenger	Version 5.0.12
Phusionpassenger Phusion Passenger	Version 5.0.13
Phusionpassenger Phusion Passenger	Version 5.0.14
Phusionpassenger Phusion Passenger	Version 5.0.15
Phusionpassenger Phusion Passenger	Version 5.0.16
Phusionpassenger Phusion Passenger	Version 5.0.17
Phusionpassenger Phusion Passenger	Version 5.0.18
Phusionpassenger Phusion Passenger	Version 5.0.19
Phusionpassenger Phusion Passenger	Version 5.0.1
Phusionpassenger Phusion Passenger	Version 5.0.20
Phusionpassenger Phusion Passenger	Version 5.0.21
Phusionpassenger Phusion Passenger	Version 5.0.2
Phusionpassenger Phusion Passenger	Version 5.0.3
Phusionpassenger Phusion Passenger	Version 5.0.4
Phusionpassenger Phusion Passenger	Version 5.0.5
Phusionpassenger Phusion Passenger	Version 5.0.6
Phusionpassenger Phusion Passenger	Version 5.0.7
Phusionpassenger Phusion Passenger	Version 5.0.8
Phusionpassenger Phusion Passenger	Version 5.0.9