What’s Vulnerable › Vulnerabilities

CVE-2017-15092

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-01-23 · updated 2026-06-17
• Weakness: CWE-79

Description

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

Affected products

• PowerDNS Recursor: from 4.0.0 through 4.0.6

References

• http://www.securityfocus.com/bid/101982
• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html
• http://www.securityfocus.com/bid/101982
• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html

Get alerted when CVE-2017-15092 or the next vulnerability affects your stack