Skip to content
Fencer Intel
high 8.8

CVE-2017-11610 in the critical feed json

Incorrect Default Permissions in Supervisor

published 9y ago modified 4mo ago also GHSA-x7c8-4x3h-874w , PYSEC-2017-41 , EUVD-2017-0132

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
87.5%
EPSS 87.5% chance of exploitation in 30 days, percentile 99.7%
public exploits
2
Metasploit and Exploit-DB, plus a Nuclei check

Summary

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Patch / fix

  • pypi supervisor 3.0.1, 3.1.4, 3.2.4, 3.3.3
  • supervisor Debian 14, Debian 13, Debian 12 3.3.1-1.1

debian advisories DEBIAN-CVE-2017-11610

  • supervisor Ubuntu 14.04 LTS 3.0b2-1ubuntu0.1
  • supervisor Ubuntu 16.04 LTS 3.2.0-2ubuntu0.2

ubuntu advisories UBUNTU-CVE-2017-11610

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cfme cloudforms managementengine 5.8 5.8.2.3-1.el7cf
  • supervisor cloudforms managementengine 5.8 3.1.4-1.el7
  • cfme-gemset cloudforms managementengine 5.8 5.8.2.3-1.el7cf
  • cfme-appliance cloudforms managementengine 5.8 5.8.2.3-1.el7cf
  • rabbitmq-server cloudforms managementengine 5.8 3.6.9-1.el7at
  • ansible-tower-setup cloudforms managementengine 5.8 3.1.5-1.el7at
  • ansible-tower-server cloudforms managementengine 5.8 3.1.5-1.el7at
  • rh-ruby23-rubygem-nokogiri cloudforms managementengine 5.8 1.8.1-2.el7cf

red hat advisories RHSA-2017:3005

  • supervisor Alpine 3.24, Alpine 3.23, Alpine 3.22 +18 more 3.2.4-r0
  • supervisor Alpine 3.3 3.1.4-r0

alpine advisories ALPINE-CVE-2017-11610

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2017-11610 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-11610 updated cvss 7.0

supervisor: Command injection via malicious XML-RPC request

  • Red Hat Ceph Storage 1.3 supervisor Red Hat Ceph Storage 2 supervisor
    affected: no fix planned “Will not fix”
  • Red Hat CloudForms Management Engine 5.8 cfme 5.8.2.3-1.el7cf, supervisor 3.1.4-1.el7, cfme-gemset 5.8.2.3-1.el7cf, rabbitmq-server 3.6.9-1.el7at, cfme-appliance 5.8.2.3-1.el7cf, ansible-tower-setup 3.1.5-1.el7at, +2 more
    fixed: vendor fix RHSA-2017:3005
  • Red Hat Mobile Application Platform 4 nagios
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/http/supervisor_xmlrpc_exec)
  2. Published

Exploit prediction

87.55% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi supervisor
<3.0.1
>=3.1.0, <3.1.4
>=3.2.0, <3.2.4
>=3.3.0, <3.3.3
>=3.1, <3.1.4
>=3.2, <3.2.4
>=3.3, <3.3.3
3.0.1
3.1.4
3.2.4
3.3.3

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.