1. CVE-Search
  2. CVE-2017-15091
ID CVE-2017-15091
Summary An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. This missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or send a NOTIFY.
References
Vulnerable Configurations
  • cpe:2.3:a:powerdns:authoritative:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.1:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.2:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.3:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:3.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:3.4.11:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:-:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:alpha2:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:alpha3:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:alpha3:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:powerdns:authoritative:4.0.4:rc1:*:*:*:*:*:*
    cpe:2.3:a:powerdns:authoritative:4.0.4:rc1:*:*:*:*:*:*
CVSS
Base: 5.5 (as of 09-10-2019 - 23:24)
Impact:
Exploitability:
CWE CWE-358
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:N/I:P/A:P
refmap via4
bid 101982
confirm https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2017-04.html
Last major update 09-10-2019 - 23:24
Published 23-01-2018 - 15:29
Last modified 09-10-2019 - 23:24
Back to Top