CVE-2017-15091 - CVE House
Back to Database
Status published High CVE-2017-15091

An issue has been found in the API component of...

Vulnerability Description

An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. This missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or send a NOTIFY.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-15091

Credits & Attribution

No credits recorded in the NVD database.

References

More from PowerDNS

View All →
CVE-2025-59030
Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
High 7.5
CVE-2025-59029
Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
Medium 5.3
CVE-2025-59024
Crafted delegations or IP fragments can poison cached delegations in Recursor
Medium 6.5
CVE-2025-59023
Crafted delegations or IP fragments can poison cached delegations in Recursor
High 8.2
CVE-2025-30195
A crafted zone can lead to an illegal memory access in the PowerDNS Recursor
High 7.5

Affected Vendor

Affected Software

PowerDNS Authoritative
Vulnerable Versions:
4.x up to and including 4.0.4, 3.x up to and including 3.4.11

Timeline

Official Publish: January 23rd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion