CVE-2017-15092 Cross-site scripting in PowerDNS Recursor
Remote attackers can inject malicious scripts into the PowerDNS Recursor web interface via unescaped DNS query names, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-15092?
CVE-2017-15092 is a medium-severity cross-site scripting vulnerability in Powerdns Recursor, published on 23 Jan 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
Weakness: CWE-79
Which versions are affected by CVE-2017-15092?
It affects 1 product.
Products include Powerdns Recursor.
How do I fix CVE-2017-15092?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-15092 being exploited?
There is no known exploitation of CVE-2017-15092 in the wild and no public exploit code.
Other vulnerabilities in Powerdns Recursor
- CVE-2009-4009 Memory corruption in n/a
- CVE-2020-10030 Memory corruption in n/a
- CVE-2025-59023 Crafted delegations or IP fragments can poison cached delegations in Recursor
- CVE-2025-59030 Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
- CVE-2023-22617 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2017-15092, GHSA-5v6v-h944-2g93, UBUNTU-CVE-2017-15092.