CVE-2017-15091CWE-863

An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations…

published January 23, 2018

CVSS
—
EPSS
1%
Percentile
68.8
In the wild
Unconfirmed
What it is

An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. This missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or send a NOTIFY.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01242 · 68.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2018-01-23T15:00Z
EPSS history
Timeline
  • 23 JAN 15:00Z
    An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations…
    cvelistv5