CVE-2017-1000215

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

• CWE-78

• https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85Third Party Advisory
• https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txtRelease Notes, Third Party Advisory
• https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acfPatch, Third Party Advisory
• https://security.gentoo.org/glsa/201903-11Third Party Advisory
• https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85Third Party Advisory
• https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txtRelease Notes, Third Party Advisory
• https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acfPatch, Third Party Advisory
• https://security.gentoo.org/glsa/201903-11Third Party Advisory

Published

Nov 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000209The Java WebSocket client nv-websocket-client does not verif…
• CVE-2017-1000210picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buff…
• CVE-2017-1000211Lynx before 2.8.9dev.16 is vulnerable to a use after free in…
• CVE-2017-1000212Elixir's vim plugin, alchemist.vim is vulnerable to remote c…
• CVE-2017-1000213WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff…
• CVE-2017-1000214GitPHP by xiphux is vulnerable to OS Command Injections
• CVE-2017-1000216Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000217Opencast 2.3.2 and older versions are vulnerable to script i…
• CVE-2017-1000218LightFTP version 1.1 is vulnerable to a buffer overflow in t…
• CVE-2017-1000219npm/KyleRoss windows-cpu all versions vulnerable to command …
• CVE-2017-1000220soyuka/pidusage <=1.1.4 is vulnerable to command injection i…
• CVE-2017-1000221In Opencast 2.2.3 and older if user names overlap, the Openc…