{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asupervisordsupervisor3.1.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supervisor:supervisor:*:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:*:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.1.1:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.1.3:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.2.2:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.2.3:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:supervisord:supervisor:3.3.2:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2017-11610"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Supervisor (\u003c= 3.3.2)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","vulnerability","cve-2017-11610","supervisor"],"_cs_type":"advisory","_cs_vendors":["Supervisor"],"content_html":"\u003cp\u003eCVE-2017-11610 is a high-severity remote code execution (RCE) vulnerability affecting Supervisor process management software, specifically versions 3.3.2 and earlier. The vulnerability exists within the XML-RPC interface of the 'supervisord' server process. An attacker with network access to the XML-RPC endpoint (defaulting to TCP port 9001) can leverage the 'supervisord.options.warnings.linecache.os.system' method to inject and execute arbitrary commands on the underlying host. Successful exploitation runs the injected commands with the privileges of the Supervisor process, which is typically root. The availability of functional proof-of-concept (PoC) code significantly increases the risk to unpatched infrastructure, particularly systems with weak or default authentication configured for the XML-RPC interface.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify accessible Supervisor XML-RPC endpoints (typically port 9001).\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the target service via HTTP POST requests directed at the '/RPC2' URI.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the XML-RPC interface using weak, default, or empty credentials.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious XML payload targeting the 'supervisor.supervisord.options.warnings.linecache.os.system' method.\u003c/li\u003e\n\u003cli\u003eThe Supervisor server-side process parses the malicious XML input without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe underlying 'os.system' call executes the attacker-supplied command string on the host OS.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves code execution with the permissions of the 'supervisord' process (typically root).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full system compromise, as the 'supervisord' service generally operates with root privileges. Victims include any organization running exposed, unpatched versions of Supervisor (3.3.2 or earlier) that have not implemented robust authentication. With an EPSS score of 87.4%, the threat is widespread, and the vulnerability is trivial to exploit given network access and weak credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Supervisor to a patched version beyond 3.3.2 or implement strict network access control lists (ACLs) to limit access to port 9001.\u003c/li\u003e\n\u003cli\u003eEnforce strong authentication for the XML-RPC interface and ensure no default or empty passwords exist.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unauthorized POST requests to '/RPC2' containing XML payloads, specifically checking for method calls including 'linecache.os.system'.\u003c/li\u003e\n\u003cli\u003eDisable the web interface if it is not required for operational tasks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T16:02:43Z","date_published":"2026-10-15T16:02:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2017-11610-supervisor/","summary":"CVE-2017-11610 is a remote code execution vulnerability in Supervisor versions 3.3.2 and earlier that allows authenticated attackers to execute arbitrary system commands via the XML-RPC interface.","title":"Remote Code Execution in Supervisor via XML-RPC","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2017-11610-supervisor/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:supervisord:supervisor:3.1.3:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}