{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-06T09:38:46.932","vulnerabilities":[{"cve":{"id":"CVE-2017-15093","sourceIdentifier":"secalert@redhat.com","published":"2018-01-23T15:29:00.383","lastModified":"2024-11-21T03:14:03.390","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration."},{"lang":"es","value":"Cuando a api-config-dir se le asigna un valor no vacío, lo que no ocurre por defecto, la API en PowerDNS Recursor 4.x hasta e incluyendo la versión 4.0.6 y en versiones 3.x hasta la 3.7.4, también incluida, permite que un usuario autorizado actualice la lista de control de acceso de Recursor añadiendo y eliminando máscaras de red y configure zonas de redirección. Se ha descubierto que las nuevas máscaras de red y las direcciones IP de las zonas redireccionadas no se validaban lo suficiente, lo que permite que un usuario autenticado inyecte nuevas directivas de configuración en la configuración de Recursor."}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndIncluding":"3.7.4","matchCriteriaId":"26A2DE9E-6667-41DF-9BFA-CC0688094368"},{"vulnerable":true,"criteria":"cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndIncluding":"4.0.6","matchCriteriaId":"94094CC8-C228-40FF-BA81-FD93082D99A2"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/101982","source":"secalert@redhat.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-06.html","source":"secalert@redhat.com","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/101982","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-06.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Patch","Vendor Advisory"]}]}}]}