CVE-2017-15092
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0...
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
CVE-2017-15092- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
CVE-2017-15092- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2017-6560 No score
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
EUVD-2017-6560- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5v6v-h944-2g93
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0...
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
GHSA-5v6v-h944-2g93- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
CVE-2017-15092- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-15092
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
DEBIAN-CVE-2017-15092- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15092
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
- Record
UBUNTU-CVE-2017-15092- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11157-1 No score
pdns-recursor-4.5.5-1.3 on GA media
These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11157-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorDebian:12 |
before 4.0.7-1 | 4.0.7-1 |
pdns-recursorDebian:13 |
before 4.0.7-1 | 4.0.7-1 |
pdns-recursorDebian:14 |
before 4.0.7-1 | 4.0.7-1 |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
pdns-recursoropenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 4.5.5-1.3 | 4.5.5-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15092 is a medium vulnerability (CVSS 6.1) in Powerdns Recursor, published January 23, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in pdns-recursor 4.0.7-1.
References
securityfocus.com/bid/101982
doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html
nvd.nist.gov/vuln/detail/CVE-2017-15092
github.com/advisories/GHSA-5v6v-h944-2g93
security-tracker.debian.org/tracker/CVE-2017-15092
ubuntu.com/security/CVE-2017-15092
Show 20 moreShow less
downloads.powerdns.com/patches/2017-05
cve.org/CVERecord?id=CVE-2017-15092
suse.com/security/cve/CVE-2016-2120