Every CVE Search/ Get API key

CVE-2017-11610

Incorrect Default Permissions in Supervisor

8.8 HighPublic exploitFix available

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

87.5%Up 20.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
CVE-2017-11610
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-276
Updated
2026-11-02
CVE List No score

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
CVE-2017-11610
Updated
2026-11-02
EUVDEUVD-2017-0132 No score

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
EUVD-2017-0132
Updated
2026-11-03
GitHub AdvisoriesGHSA-x7c8-4x3h-874w 8.7

Incorrect Default Permissions in Supervisor

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
GHSA-x7c8-4x3h-874w
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
OSVALPINE-CVE-2017-11610 8.8

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
ALPINE-CVE-2017-11610
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
CVE-2017-11610
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2017-11610 8.8

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
DEBIAN-CVE-2017-11610
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-x7c8-4x3h-874w 8.7

Incorrect Default Permissions in Supervisor

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
GHSA-x7c8-4x3h-874w
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
OSVRHSA-2017:3005 8.4

Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

Record
RHSA-2017:3005
CVSS 3.0
8.4 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-11610 8.8

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
UBUNTU-CVE-2017-11610
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0263 No score

Updated supervisor packages fix security vulnerability

A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root (CVE-2017-11610).

Record
MGASA-2017-0263
Updated
2026-11-02
OSVPYSEC-2017-41 No score

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Record
PYSEC-2017-41
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
supervisor
PyPI
 before 3.0.1
3.0.1
supervisor
PyPI
 3.1.0 up to 3.1.4
3.1.4
supervisor
PyPI
 3.2.0 up to 3.2.4
3.2.4
supervisor
PyPI
 3.3.0 up to 3.3.3
3.3.3
supervisor
Alpine:v3.10
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.11
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.12
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.13
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.14
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.15
 before 3.2.4-r0
3.2.4-r0
Show 43 moreShow less
Affected packages
PackageAffectedFixed
supervisor
Alpine:v3.16
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.17
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.18
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.19
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.20
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.21
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.22
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.23
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.24
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.3
 before 3.1.4-r0
3.1.4-r0
supervisor
Alpine:v3.4
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.5
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.6
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.7
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.8
 before 3.2.4-r0
3.2.4-r0
supervisor
Alpine:v3.9
 before 3.2.4-r0
3.2.4-r0
supervisor
Debian:12
 before 3.3.1-1.1
3.3.1-1.1
supervisor
Debian:13
 before 3.3.1-1.1
3.3.1-1.1
supervisor
Debian:14
 before 3.3.1-1.1
3.3.1-1.1
supervisor
Debian:7
 before 3.0a8-1.1+deb7u2, plus listed versions
3.0a8-1.13.0a8-1.1+deb7u1
3.0a8-1.1+deb7u2
supervisor
Debian:8
 before 3.0r1-1+deb8u1, plus listed versions
3.0r1-1
3.0r1-1+deb8u1
supervisor
Debian:9
 before 3.3.1-1+deb9u1, plus listed versions
3.3.1-1
3.3.1-1+deb9u1
supervisor
PyPI
 before 3.0.1, plus listed versions
2.02.0b12.12.1b12.2b1
Show 16 moreShow less
3.03.0a13.0a103.0a113.0a123.0a23.0a33.0a43.0a53.0a63.0a73.0a83.0a93.0b13.0b2a3
3.0.1
supervisor
PyPI
 3.1.0 up to 3.1.4, plus listed versions
3.1.13.1.23.1.3
3.1.4
supervisor
PyPI
 3.2.0 up to 3.2.4, plus listed versions
3.2.13.2.23.2.3
3.2.4
supervisor
PyPI
 3.3.0 up to 3.3.3, plus listed versions
3.3.13.3.2
3.3.3
supervisor
Mageia:5
 before 3.0.1-1.mga5
3.0.1-1.mga5
supervisor
Mageia:6
 before 3.1.4-1.mga6
3.1.4-1.mga6
supervisor
PyPI
 before 3.0.1, 3.1 up to 3.1.4, 3.2 up to 3.2.4, 3.3 up to 3.3.3, plus listed versions
2.02.0b12.12.1b12.2b1
Show 27 moreShow less
3.03.0a13.0a103.0a113.0a123.0a23.0a33.0a43.0a53.0a63.0a73.0a83.0a93.0b13.0b23.1.03.1.13.1.23.1.33.2.03.2.13.2.23.2.33.3.03.3.13.3.2a3
3.0.13.1.43.2.43.3.3
ansible-tower-server
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:3.1.5-1.el7at
0:3.1.5-1.el7at
ansible-tower-setup
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:3.1.5-1.el7at
0:3.1.5-1.el7at
cfme
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:5.8.2.3-1.el7cf
0:5.8.2.3-1.el7cf
cfme-appliance
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:5.8.2.3-1.el7cf
0:5.8.2.3-1.el7cf
cfme-appliance-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:5.8.2.3-1.el7cf
0:5.8.2.3-1.el7cf
cfme-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:5.8.2.3-1.el7cf
0:5.8.2.3-1.el7cf
cfme-gemset
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:5.8.2.3-1.el7cf
0:5.8.2.3-1.el7cf
rabbitmq-server
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:3.6.9-1.el7at
0:3.6.9-1.el7at
rh-ruby23-rubygem-nokogiri
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:1.8.1-2.el7cf
0:1.8.1-2.el7cf
rh-ruby23-rubygem-nokogiri-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:1.8.1-2.el7cf
0:1.8.1-2.el7cf
rh-ruby23-rubygem-nokogiri-doc
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:1.8.1-2.el7cf
0:1.8.1-2.el7cf
supervisor
Red Hat:cloudforms_managementengine:5.8::el7
From an advisory covering 2 CVEs
 before 0:3.1.4-1.el7
0:3.1.4-1.el7
supervisor
Ubuntu:14.04:LTS
 before 3.0b2-1ubuntu0.1, plus listed versions
3.0b2-1
3.0b2-1ubuntu0.1
supervisor
Ubuntu:16.04:LTS
 before 3.2.0-2ubuntu0.2, plus listed versions
3.0r1-13.1.3-13.2.0-13.2.0-23.2.0-2ubuntu0.1
3.2.0-2ubuntu0.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitSupervisor XML-RPC Authenticated Remote Code Execution2017-07-19
Exploit-DBSupervisor 3.0a1 < 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit)2017-09-25
PoC in GitHubivanitlearning/CVE-2017-116102019-11-02
PoC in GitHubyaunsky/CVE-2017-116102020-12-22
PoC in GitHubDungsocool/CVE-2017-116102026-05-27
PoC in GitHubCyberCTF/vulhub-supervisor-cve-2017-116102026-10-08
NucleiXML-RPC Server - Remote Code Execution

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11610 is a high vulnerability (CVSS 8.8) in Supervisord Supervisor, published July 31, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.5%, the 99th percentile. Fixed in supervisor 3.0.1.

References

Show 187 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open