CVE-2017-11610: debian debian_linux Incorrect Default Permissions
Vulnerability summary
CVE-2017-11610 is a high (CVSS 9.0) Incorrect Default Permissions vulnerability in debian debian_linux. EPSS estimates a 87.38% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-08-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
87.38%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 87.38% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundSupervisor 3.0a1 < 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit)
Maturity: weaponized
Supervisor XML-RPC Authenticated Remote Code Execution
exploit/linux/http/supervisor_xmlrpc_exec
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian2 products
- supervisor< 3.3.1-1.1 | < 3.0r1-1+deb8u1 | < 3.3.1-1+deb9u1 | < 3.0a8-1.1+deb7u2
- debian_linuxEOL8.0 | 9.0
Mageia2 products
- supervisor< 3.0.1-1.mga5
- supervisor< 3.1.4-1.mga6
Alpine1 product
- supervisor< 3.2.4-r0 | < 3.1.4-r0
Fedoraproject1 product
- fedoraEOL24 | 25 | 26
PyPI1 product
- supervisor< 3.0.1 | ≥ 3.1.0, < 3.1.4 | ≥ 3.2.0, < 3.2.4 | ≥ 3.3.0, < 3.3.3 | ≥ 3.3, < 3.3.3
Redhat1 product
- cloudforms4.5
Supervisord1 product
- supervisor≤ 3.0 | 3.1.0 | 3.1.1 | 3.1.2 | 3.1.3 | 3.2.0 | 3.2.1 | 3.2.2 | 3.2.3 | 3.3.0 | 3.3.1 | 3.3.2
Ubuntu1 product
- supervisor< 3.0b2-1ubuntu0.1 | < 3.2.0-2ubuntu0.2
8 vendors · 10 products
References
30 links- access.redhat.com/errata/RHSA-2017:3005Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txtX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
- github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txtX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
- github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txtX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
- github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txtX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
www.debian.org/security/2017/dsa-3942Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEBAdvisory- github.com/Supervisor/supervisor/issues/964X Refsource CONFIRMIssue TrackingVendor AdvisoryWEBREPORT
