GoogleOSV:GHSA-X7C8-4X3H-874WIncorrect Default Permissions in Supervisor
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
| CPE | Name | Operator | Version |
|---|---|---|---|
| supervisor | eq | 3.0a8 | |
| supervisor | eq | 3.0b2 | |
| supervisor | eq | 3.1.2 | |
| supervisor | eq | 3.0a2 | |
| supervisor | eq | 2.0 | |
| supervisor | eq | 3.0a10 | |
| supervisor | eq | 2.1 | |
| supervisor | eq | 3.0a12 | |
| supervisor | eq | 3.0a3 | |
| supervisor | eq | 3.0a7 |
References
www.debian.org/security/2017/dsa-3942
access.redhat.com/errata/RHSA-2017:3005
github.com/Supervisor/supervisor
github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt
github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt
github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt
github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt
github.com/Supervisor/supervisor/issues/964
lists.fedoraproject.org/archives/list/[email protected]/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B
lists.fedoraproject.org/archives/list/[email protected]/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM
lists.fedoraproject.org/archives/list/[email protected]/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ
nvd.nist.gov/vuln/detail/CVE-2017-11610
security.gentoo.org/glsa/201709-06
www.exploit-db.com/exploits/42779
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%