PT-2018-5759 · Powerdns · Powerdns Recursor

Chris Navarrete · Publicado 2018-01-23 · Atualizado 2024-06-15 · CVE-2017-15092

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 4.0.0 through 4.0.6

Description: A cross-site scripting issue has been found in the web interface, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

Recommendations: For versions 4.0.0 through 4.0.6, update to a version that includes the fix for this issue to prevent cross-site scripting attacks.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-15092

OPENSUSE-SU-2024:11157-1

Produtos afetados

Powerdns Recursor

Referências · 29

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15092 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-14196 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Aviso do Fabricante
• https://downloads.powerdns.com/patches/2017-05 · Nota
• https://ubuntu.com/security/CVE-2017-15092 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2120 · Nota
• https://suse.com/security/cve/CVE-2018-10851 · Nota
• https://suse.com/security/cve/CVE-2020-25829 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15092 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-16855 · Nota
• https://suse.com/security/cve/CVE-2020-10995 · Nota
• https://suse.com/security/cve/CVE-2017-15094 · Nota
• https://suse.com/security/cve/CVE-2018-14644 · Nota
• http://securityfocus.com/bid/101982 · Nota
• https://suse.com/security/cve/CVE-2020-10030 · Nota