CVE-2017-20217CWE-306

Serviio PRO 1.8 REST API Information Disclosure

High · published March 15, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrieve potentially sensitive configuration data without authentication.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00672 · 51.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-15T18:34Z
EPSS history
Timeline
  • 15 MAR 18:34Z
    Serviio PRO 1.8 REST API Information Disclosure
    cvelistv5