CVE-2017-11610
CVE-2017-11610
Vexday Risk Score
82Corregir ahora
Decisión SSVC (CISA)
Act
Explotación + impacto → acción inmediata
Madurez del exploit
Exploit funcional
PoC popular en GitHub (4 estrellas) — código de explotación ampliamente disponible.
CVSS —EPSS 87.5%KEV nãoPoC públicaNuclei simMetasploit simPatch referenciado
Ciclo de vida
19 jul 2017Exploit Metasploit disponible
23 ago 2017Publicada en NVD
25 sep 2017PoC pública
Velocidad de armamento
32 díashasta el primer PoC
Recomendación: Corregir cuanto antes — hay explotación activa confirmada.
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Productos afectados
n/a · n/aPoCs públicas encontradas — 8
githubgithub.com/yaunsky/CVE-2017-11610★ 4githubgithub.com/Dungsocool/CVE-2017-11610★ 0githubgithub.com/ivanitlearning/CVE-2017-11610★ 0vulncheckvulncheck.com/xdb/bf74e8240eb3no verificadocve_referencewww.exploit-db.com/exploits/42779/no verificadovulncheckvulncheck.com/xdb/aff38bcfb069no verificadoexploitdbwww.exploit-db.com/exploits/42779no verificadovulncheckvulncheck.com/xdb/60c1a10938b9no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://access.redhat.com/errata/RHSA-2017:3005https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txthttps://github.com/Supervisor/supervisor/issues/964https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/https://security.gentoo.org/glsa/201709-06https://www.exploit-db.com/exploits/42779/http://www.debian.org/security/2017/dsa-3942