CVE-2017-9822highunder attackransomwareCWE-94

CVE-2017-9822: high-severity vulnerability in DotNetNuke CMS Fixed in 9.1.1

Published · Updated

Follow this CVE+ Monitor DotNetNuke+ Monitor DotNetNuke CMS Fixed in

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 95%
from disclosure to weapon1001 days
Published on NVDJul 20
1st PoC+1001d
metasploitJul 20
CISA KEV+1567d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

DNN (DotNetNuke) versions before 9.1.1 allow attackers to execute arbitrary code on the server through a specially crafted cookie. This is a critical flaw because it gives attackers full control over the website and its data without needing valid credentials.

Technical detail

DNN before 9.1.1 is vulnerable to remote code execution via unsafe deserialization of cookie data (CWE-94). An unauthenticated attacker can craft a malicious cookie that, when processed by the application, executes arbitrary code with the privileges of the web process. This requires network access to the vulnerable application but no prior authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
DotNetNuke · DotNetNuke CMS Fixed in 9.1.1
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.