CVE-2017-15092

Description

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

CVSS Metrics

• v3.0•MEDIUM•Score: 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.00%• Percentile: 0%

Techniques & Countermeasures

• CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

• powerdns•powerdns_recursor

  from 4.0.0 up to and including 4.0.6

• powerdns•recursor

  ≥ 4.0.0, ≤ 4.0.6

References (2)

• http://www.securityfocus.com/bid/101982
• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html