What’s Vulnerable › Vulnerabilities

CVE-2017-1000215

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-17 · updated 2026-06-17
• Weakness: CWE-78

Description

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

Affected products

• Xrootd: through 4.6.0

References

• https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85
• https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txt
• https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acf
• https://security.gentoo.org/glsa/201903-11
• https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85
• https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txt
• https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acf
• https://security.gentoo.org/glsa/201903-11

Get alerted when CVE-2017-1000215 or the next vulnerability affects your stack