Search criteria
2 vulnerabilities by supervisord
CVE-2019-12105 (GCVE-0-2019-12105)
Vulnerability from cvelistv5 – Published: 2019-09-10 16:18 – Updated: 2024-08-04 23:10 Disputed
VLAI
Summary
In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Supervisor/supervisor/commit/4… | x_refsource_MISC |
| https://github.com/Supervisor/supervisor/issues/1245 | x_refsource_MISC |
| http://supervisord.org/configuration.html#inet-ht… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-12105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T18:36:35.707915Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T18:36:42.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:10:30.578Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/issues/1245"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://supervisord.org/configuration.html#inet-http-server-section-settings"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-17T21:53:52.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Supervisor/supervisor/issues/1245"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://supervisord.org/configuration.html#inet-http-server-section-settings"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-12105",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb",
"refsource": "MISC",
"url": "https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb"
},
{
"name": "https://github.com/Supervisor/supervisor/issues/1245",
"refsource": "MISC",
"url": "https://github.com/Supervisor/supervisor/issues/1245"
},
{
"name": "http://supervisord.org/configuration.html#inet-http-server-section-settings",
"refsource": "MISC",
"url": "http://supervisord.org/configuration.html#inet-http-server-section-settings"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-12105",
"datePublished": "2019-09-10T16:18:27.000Z",
"dateReserved": "2019-05-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T23:10:30.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11610 (GCVE-0-2017-11610)
Vulnerability from cvelistv5 – Published: 2017-08-23 14:00 – Updated: 2024-08-05 18:12
VLAI
Summary
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2017:3005 | vendor-advisoryx_refsource_REDHAT |
| https://github.com/Supervisor/supervisor/blob/3.3… | x_refsource_CONFIRM |
| https://github.com/Supervisor/supervisor/blob/3.0… | x_refsource_CONFIRM |
| https://github.com/Supervisor/supervisor/blob/3.2… | x_refsource_CONFIRM |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://github.com/Supervisor/supervisor/blob/3.1… | x_refsource_CONFIRM |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| http://www.debian.org/security/2017/dsa-3942 | vendor-advisoryx_refsource_DEBIAN |
| https://github.com/Supervisor/supervisor/issues/964 | x_refsource_CONFIRM |
| https://www.exploit-db.com/exploits/42779/ | exploitx_refsource_EXPLOIT-DB |
| https://security.gentoo.org/glsa/201709-06 | vendor-advisoryx_refsource_GENTOO |
Date Public
2017-07-24 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:12:40.456Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2017:3005",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:3005"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt"
},
{
"name": "FEDORA-2017-307eab89e1",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/"
},
{
"name": "FEDORA-2017-85eb9f7a36",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt"
},
{
"name": "FEDORA-2017-713430fb15",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/"
},
{
"name": "DSA-3942",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3942"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Supervisor/supervisor/issues/964"
},
{
"name": "42779",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/42779/"
},
{
"name": "GLSA-201709-06",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201709-06"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-07-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-01T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "RHSA-2017:3005",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:3005"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt"
},
{
"name": "FEDORA-2017-307eab89e1",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/"
},
{
"name": "FEDORA-2017-85eb9f7a36",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt"
},
{
"name": "FEDORA-2017-713430fb15",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/"
},
{
"name": "DSA-3942",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3942"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Supervisor/supervisor/issues/964"
},
{
"name": "42779",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/42779/"
},
{
"name": "GLSA-201709-06",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201709-06"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-11610",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2017:3005",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:3005"
},
{
"name": "https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt",
"refsource": "CONFIRM",
"url": "https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt"
},
{
"name": "https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt",
"refsource": "CONFIRM",
"url": "https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt"
},
{
"name": "https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt",
"refsource": "CONFIRM",
"url": "https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt"
},
{
"name": "FEDORA-2017-307eab89e1",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/"
},
{
"name": "FEDORA-2017-85eb9f7a36",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/"
},
{
"name": "https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt",
"refsource": "CONFIRM",
"url": "https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt"
},
{
"name": "FEDORA-2017-713430fb15",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/"
},
{
"name": "DSA-3942",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3942"
},
{
"name": "https://github.com/Supervisor/supervisor/issues/964",
"refsource": "CONFIRM",
"url": "https://github.com/Supervisor/supervisor/issues/964"
},
{
"name": "42779",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/42779/"
},
{
"name": "GLSA-201709-06",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201709-06"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-11610",
"datePublished": "2017-08-23T14:00:00.000Z",
"dateReserved": "2017-07-24T00:00:00.000Z",
"dateUpdated": "2024-08-05T18:12:40.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}