CVE-2017-17384
HighSummary
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
Risk Assessment
Organizations may be exposed to unauthorized access to the system, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade ISPConfig to version 3.1.9 or later to mitigate this vulnerability.
Other vulnerabilities in ISPConfig
See all- CVE-2026-61518High
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter in delete and update methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding. A user with any low-privilege function permission can inject arbitrary SQL, delete or modify records across all tenants, and extract data including password hashes.
- CVE-2025-52206Medium
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. This allows an attacker to inject malicious scripts into the administrator's browser.
Original NVD description (English source)
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.