CVE-2017-1000215

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85Third Party Advisory
https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txtRelease Notes, Third Party Advisory
https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acfPatch, Third Party Advisory
https://security.gentoo.org/glsa/201903-11Third Party Advisory
https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85Third Party Advisory
https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txtRelease Notes, Third Party Advisory
https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acfPatch, Third Party Advisory
https://security.gentoo.org/glsa/201903-11Third Party Advisory

Timeline

Published: Nov 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10002178.8Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in CVE-2017-10002189.8LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code exec CVE-2017-10002199.8npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user CVE-2017-10002209.8soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution CVE-2017-10002216.5In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will ha CVE-2017-10002235.4A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated CVE-2017-10002246.5CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin CVE-2017-10002256.1Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anyt CVE-2017-10002265.3Stop User Enumeration 1.3.8 allows user enumeration via the REST API CVE-2017-10002275.4Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin c CVE-2017-10002289.8nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function CVE-2017-10002297.8Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of servic