Skip to content

CVE-2017-9822 DNN (aka DotNetNuke) has Remote Code Execution via a cookie

HighCVSS 8.8 EPSS 94.8% CISA KEV added 2021-11-03 · due 2022-05-03 Ransomware Exploited in the wild Framework module Public exploit
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

CISA Known Exploited Vulnerability

Date added
2021-11-03
Due date (FCEB)
2022-05-03
Ransomware use
Known

Required action

Apply updates per vendor instructions.

Affected products

ProductAffected versionsFixed in
nuget DotNetNuke.Core(NuGet) < 9.1.1 9.1.1
nuget DotNetNuke.Core(NuGet) = 6.0.0 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.0.0 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.0.6.121 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.1.0 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.1.2 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.2.0.613 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.3.0.499 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.3.1.20 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.4.0.353 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.4.1.280 No fix listed
nuget DotNetNuke.Core(NuGet) = 7.4.2.216 No fix listed
nuget DotNetNuke.Core(NuGet) = 8.0.0.809 No fix listed
nuget DotNetNuke.Core(NuGet) = 8.0.1.239 No fix listed
nuget DotNetNuke.Core(NuGet) = 8.0.2.4 No fix listed
nuget DotNetNuke.Core(NuGet) = 8.0.3.5 No fix listed
nuget DotNetNuke.Core(NuGet) = 8.0.4.226 No fix listed
nuget DotNetNuke.Core(NuGet) = 9.0.0.1002 No fix listed
nuget DotNetNuke.Core(NuGet) = 9.0.1.142 No fix listed
nuget DotNetNuke.Core(NuGet) = 9.1.0.367 No fix listed
dnnsoftware dotnetnuke < 9.1.1 9.1.1
DotNetNuke CMS Fixed in 9.1.1 = DotNetNuke CMS Fixed in 9.1.1 No fix listed

References