API Misconfiguration in PowerDNS Authoritative 4.x and 3.x by PowerDNS
CVE-2017-15091

7.1HIGH

Key Information:

Vendor
Powerdns
Status
Powerdns Authoritative
Vendor
CVE Published:
23 January 2018

Summary

A flaw exists in the API component of PowerDNS Authoritative versions 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11. Specifically, operations that affect the server state can still be executed despite the API being set to read-only through the api-readonly configuration. This oversight allows an attacker with valid API credentials to perform actions such as flushing the cache, initiating a zone transfer, or sending a NOTIFY, which may compromise the server's integrity and operational security.

Affected Version(s)

PowerDNS Authoritative 4.x up to and including 4.0.4

PowerDNS Authoritative 3.x up to and including 3.4.11

References

http://www.securityfocus.com/bid/101982
vdb-entryx_refsource_BID
https://doc.powerdns.com/authoritative/security-advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.