CVE-2017-15092
CVE-2017-15092
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
CVSS 6.1 · Medium · EPSS 2.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
powerdns recursor
- Versions
- from 4.0.0 up to and including 4.0.6: Affected
No fix published
pdns-recursor Debian:12
- Affected ranges
- ECOSYSTEM: < 4.0.7-1
Update to 4.0.7-1
pdns-recursor Debian:13
- Affected ranges
- ECOSYSTEM: < 4.0.7-1
Update to 4.0.7-1
pdns-recursor Debian:14
- Affected ranges
- ECOSYSTEM: < 4.0.7-1
Update to 4.0.7-1
pdns-recursor Ubuntu:Pro:16.04:LTS
- Versions
- 3.7.3-1
- 4.0.0~alpha1-1
- 4.0.0~alpha1-2
- 4.0.0~alpha2-2
- 4.0.0~alpha2-2ubuntu0.1
- 4.0.0~alpha2-2ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published