PT-2018-5759 · Powerdns · Powerdns Recursor

Chris Navarrete · Published 2018-01-23 · Updated 2024-06-15 · CVE-2017-15092

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 4.0.0 through 4.0.6

Description: A cross-site scripting issue has been found in the web interface, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

Recommendations: For versions 4.0.0 through 4.0.6, update to a version that includes the fix for this issue to prevent cross-site scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-15092

OPENSUSE-SU-2024:11157-1

Affected Products

Powerdns Recursor

References · 29

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15092 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15092 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-15092 · Security Note
• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15092 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15092 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15092 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-14196 · Note
• https://downloads.powerdns.com/patches/2017-05 · Note
• https://suse.com/security/cve/CVE-2016-2120 · Note
• https://suse.com/security/cve/CVE-2018-10851 · Note
• https://suse.com/security/cve/CVE-2020-25829 · Note
• https://suse.com/security/cve/CVE-2018-16855 · Note