QwikSec

Security Database

CVE

CWE

Training

CVE-2017-15092

Published: Jan 23, 2018

Modified: Sep 17, 2024

PUBLISHED

Description

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

Vendor	Product	Versions
PowerDNS	PowerDNS Recursor	affected `from 4.0.0 up to and including 4.0.6`

Weaknesses (CWE)

References

vdb-entry

x_refsource_BID

https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.