{"id":"CVE-2017-11610","aliases":["ALPINE-CVE-2017-11610","DEBIAN-CVE-2017-11610","DLA-1047-1","DSA-3942-1","EUVD-2017-0132","GHSA-x7c8-4x3h-874w","MGASA-2017-0263","PYSEC-2017-41","RHSA-2017:3005","UBUNTU-CVE-2017-11610"],"status":"published","title":"Incorrect Default Permissions in Supervisor","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.87549,"percentile":0.9976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-276"],"published":"2017-07-31T00:00:00Z","modified":"2026-10-20T10:47:42Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/supervisor_xmlrpc_exec","title":"Supervisor XML-RPC Authenticated Remote Code Execution","type":"exploit","platform":"Linux","date":"2017-07-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/supervisor_xmlrpc_exec"},{"source":"exploitdb","id":"EDB-42779","title":"Supervisor 3.0a1 \u003c 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit)","type":"remote","platform":"linux","date":"2017-09-25","verified":true,"url":"https://www.exploit-db.com/exploits/42779"},{"source":"pocgithub","id":"ivanitlearning/CVE-2017-11610","title":"ivanitlearning/CVE-2017-11610","date":"2019-11-02","url":"https://github.com/ivanitlearning/CVE-2017-11610"},{"source":"pocgithub","id":"yaunsky/CVE-2017-11610","title":"yaunsky/CVE-2017-11610","date":"2020-12-22","url":"https://github.com/yaunsky/CVE-2017-11610"},{"source":"pocgithub","id":"Dungsocool/CVE-2017-11610","title":"Dungsocool/CVE-2017-11610","date":"2026-05-27","url":"https://github.com/Dungsocool/CVE-2017-11610"},{"source":"pocgithub","id":"CyberCTF/vulhub-supervisor-cve-2017-11610","title":"CyberCTF/vulhub-supervisor-cve-2017-11610","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-supervisor-cve-2017-11610"},{"source":"nuclei","id":"CVE-2017-11610","title":"XML-RPC Server - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11610.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"supervisor","fixed_in":["3.0.1","3.1.4","3.2.4","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"supervisor","fixed_in":["3.1.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"supervisor","fixed_in":["3.2.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"supervisor","fixed_in":["3.3.1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"supervisor","fixed_in":["3.3.1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"supervisor","fixed_in":["3.3.1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"supervisor","fixed_in":["3.0a8-1.1+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"supervisor","fixed_in":["3.0r1-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"supervisor","fixed_in":["3.3.1-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"supervisor","fixed_in":["3.0.1-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"supervisor","fixed_in":["3.1.4-1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"supervisor","fixed_in":["3.0b2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"supervisor","fixed_in":["3.2.0-2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0a8-1.1+deb7u2"}]}],"versions":["3.0a8-1.1","3.0a8-1.1+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0r1-1+deb8u1"}]}],"versions":["3.0r1-1"]},{"source":"osv","ecosystem":"Debian:9","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1+deb9u1"}]}],"versions":["3.3.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["2.0","2.0b1","2.1","2.1b1","2.2b1","3.0","3.0a1","3.0a10","3.0a11","3.0a12","3.0a2","3.0a3","3.0a4","3.0a5","3.0a6","3.0a7","3.0a8","3.0a9","3.0b1","3.0b2","a3"]},{"source":"osv","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.4"}]}],"versions":["3.1.0","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.4"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Mageia:5","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-1.mga6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"},{"introduced":"3.1"},{"fixed":"3.1.4"},{"introduced":"3.2"},{"fixed":"3.2.4"},{"introduced":"3.3"},{"fixed":"3.3.3"}]}],"versions":["2.0","2.0b1","2.1","2.1b1","2.2b1","3.0","3.0a1","3.0a10","3.0a11","3.0a12","3.0a2","3.0a3","3.0a4","3.0a5","3.0a6","3.0a7","3.0a8","3.0a9","3.0b1","3.0b2","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.2.2","3.2.3","3.3.0","3.3.1","3.3.2","a3"]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible-tower-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el7at"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible-tower-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el7at"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.2.3-1.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.2.3-1.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.2.3-1.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.2.3-1.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.2.3-1.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.9-1.el7at"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el7cf"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0b2-1ubuntu0.1"}]}],"versions":["3.0b2-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-2ubuntu0.2"}]}],"versions":["3.0r1-1","3.1.3-1","3.2.0-1","3.2.0-2","3.2.0-2ubuntu0.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"cloudforms"},{"vendor":"supervisord","product":"supervisor"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:3005","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3942","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Supervisor/supervisor/issues/964","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.exploit-db.com/exploits/42779/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://security.gentoo.org/glsa/201709-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11610","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x7c8-4x3h-874w","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/supervisor/PYSEC-2017-41.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/42779","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-11610","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11610","tags":["advisory"]},{"url":"https://github.com/Supervisor/supervisor","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21477","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.5/html/release_notes/index#red_hat_cloudforms_4_5_2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478418","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478529","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478558","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478563","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480586","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482670","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1485474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1486351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1486474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487320","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1488967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1489974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1491310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1492840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1496912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1496946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497746","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1499868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1502738","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3005.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11610","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12148","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-11610","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-11610","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:00:00Z","modified":"2024-08-05T18:12:40.456Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-0132","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:00:00Z","modified":"2024-08-05T18:12:40Z","updated_at":"2026-11-03T02:23:23.645757Z"}],"ghsa":[{"id":"GHSA-x7c8-4x3h-874w","title":"Incorrect Default Permissions in Supervisor","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2022-05-13T01:42:26Z","modified":"2024-10-28T14:26:55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2017-11610","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:29:00.237Z","modified":"2026-06-17T01:02:04.833Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"ALPINE-CVE-2017-11610","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:29:00.237Z","modified":"2026-06-15T18:18:06.731357443Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-11610","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:29:00.237Z","modified":"2026-10-20T10:47:42.189408563Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11610","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:29:00.237Z","modified":"2026-09-01T20:03:41.951339049Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"GHSA-x7c8-4x3h-874w","title":"Incorrect Default Permissions in Supervisor","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2022-05-13T01:42:26Z","modified":"2024-10-28T14:44:48.215197Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"RHSA-2017:3005","title":"Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:28:23Z","modified":"2026-07-01T10:02:56Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-11610","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:29:00Z","modified":"2025-09-08T16:44:19Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1047-1","title":"supervisor - security update","status":"published","published":"2017-07-31T00:00:00Z","modified":"2026-03-09T01:01:45.935061Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3942-1","title":"supervisor - security update","status":"published","published":"2017-08-13T00:00:00Z","modified":"2026-03-09T01:18:54.064471Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0263","title":"Updated supervisor packages fix security vulnerability","description":"A vulnerability has been found where an authenticated client can send a\nmalicious XML-RPC request to supervisord that will run arbitrary shell\ncommands on the server. The commands will be run as the same user as\nsupervisord. Depending on how supervisord has been configured, this may\nbe root (CVE-2017-11610).\n","status":"published","published":"2017-08-13T13:17:41Z","modified":"2026-04-16T06:25:11.348735501Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"PYSEC-2017-41","description":"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.","status":"published","published":"2017-08-23T14:29:00Z","modified":"2023-11-08T03:58:49.782742Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}