CVE-2017-15093CWE-20

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and…

published January 23, 2018

CVSS
—
EPSS
1%
Percentile
57.1
In the wild
Unconfirmed
What it is

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00828 · 57.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-01-23T15:00Z
EPSS history
Timeline
  • 23 JAN 15:00Z
    When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and…
    cvelistv5