CVE-2017-11610

critical-risk

Published 2017-08-23

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Do I need to act?

93.8% chance of exploitation in next 30 days

EPSS score — higher than 6% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

42779

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (18)

Supervisor

Fedora

Debian Linux

Supervisor

Fedora

Cloudforms

Affected Vendors

Redhat Fedoraproject Supervisord Debian

References (24)

Third Party Advisory http://www.debian.org/security/2017/dsa-3942

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3005

Release Notes https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt

Release Notes https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt

Release Notes https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt

Release Notes https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt

Issue Tracking https://github.com/Supervisor/supervisor/issues/964

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/201709-06

Exploit https://www.exploit-db.com/exploits/42779/

Third Party Advisory http://www.debian.org/security/2017/dsa-3942

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3005

Release Notes https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt

Release Notes https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt

Release Notes https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt

Release Notes https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt

Issue Tracking https://github.com/Supervisor/supervisor/issues/964

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

and 4 more references

/ 100

critical-risk

Severity 30/34 · Critical

Exploitability 27/34 · High

Exposure 19/34 · Moderate