UpHeron
All vulnerabilities

Servers and applications

CVE-2017-17384

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

Severity
High 8.8
Published
7 Dec 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.5% in the next 30 daysHigher than 74% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Improper privilege management (CWE-269)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
ISPConfigServers and applications · cpe:a:ispconfig:ispconfig
  • Version 3.1.8-p1
  • Version 3.1.8
  • Version 3.1.7-p1
  • Version 3.1.7
All 56 release lines
  • Version 3.0.2
  • Version 3.0.2.1
  • Version 3.0.2.2-b1
  • Version 3.0.2.2
  • Version 3.0.3-b1
  • Version 3.0.3-rc1
  • Version 3.0.3
  • Version 3.0.3.1-rc1
  • Version 3.0.3.1-rc2
  • Version 3.0.3.1
  • Version 3.0.3.2-rc1
  • Version 3.0.3.2
  • Version 3.0.3.3-rc1
  • Version 3.0.3.3
  • Version 3.0.4-b1
  • Version 3.0.4
  • Version 3.0.4.1-rc1
  • Version 3.0.4.1-rc2
  • Version 3.0.4.1
  • Version 3.0.4.2
  • Version 3.0.4.3
  • Version 3.0.4.6-rc1
  • Version 3.0.4.6
  • Version 3.0.5-alpha1
  • Version 3.0.5-b1
  • Version 3.0.5-rc1
  • Version 3.0.5-rc2
  • Version 3.0.5
  • Version 3.0.5.1
  • Version 3.0.5.2
  • Version 3.0.5.3
  • Version 3.0.5.4-b1
  • Version 3.0.5.4-rc1
  • Version 3.0.5.4-rc2
  • Version 3.0.5.4
  • Version 3.0.5.4-p1
  • Version 3.0.5.4-p2
  • Version 3.0.5.4-p3
  • Version 3.0.5.4-p4
  • Version 3.0.5.4-p5
  • Version 3.0.5.4-p6
  • Version 3.0.5.4-p7
  • Version 3.0.5.4-p8
  • Version 3.0.5.4-p9
  • Version 3.1
  • Version 3.1.1
  • Version 3.1.1-p1
  • Version 3.1.2
  • Version 3.1.3
  • Version 3.1.4
  • Version 3.1.5
  • Version 3.1.6
  • Version 3.1.7
  • Version 3.1.7-p1
  • Version 3.1.8
  • Version 3.1.8-p1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-17384
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-17384