Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2017-15092: PowerDNS Recursor web UI can run injected scripts
CVE-2017-15092 · published 8 years ago
Summary
The web interface of PowerDNS Recursor versions 4.0.0 through 4.0.6 shows DNS query names without cleaning them first. An attacker could place malicious HTML or JavaScript in a query name and have it executed when the page is viewed, potentially altering what users see. Update to a newer version or apply the vendor’s patch to properly escape displayed data.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| powerdns | recursor |
>= 4.0.0, <= 4.0.6 cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* |
Original advisory text
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowi...
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
References
- http://www.securityfocus.com/bid/101982 Third Party Advisory VDB Entry
- https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.... Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Jan 2018
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-15092 · NVD
Track software like this
Free during beta