GitHub Advisoryadvisory · PyPI

GHSA-x7c8-4x3h-874w Incorrect Default Permissions in Supervisor

HIGH Published 2022-05-13 Modified 2024-10-28 Official page ↗
Aliases
CVE-2017-11610
Ecosystem
PyPI
Packages
supervisor
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276
Reviewed
2022-07-01

Affected packages

• PyPI supervisor: < 3.0.1 → fixed in 3.0.1 • PyPI supervisor: >= 3.1.0, < 3.1.4 → fixed in 3.1.4 • PyPI supervisor: >= 3.2.0, < 3.2.4 → fixed in 3.2.4 • PyPI supervisor: >= 3.3.0, < 3.3.3 → fixed in 3.3.3

Description

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Related

Alias · CVE (1)

  • CVE-2017-11610 The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References