Actively exploited · Published Jul 20, 2017 · Assigned by hpe
CVE-2017-9822
High 8.8 Exploited Ransomware
In plain English
A high-severity code injection in DotNetNuke CMS Fixed in 9.1.1 from DotNetNuke. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 94.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | dotnetnuke.core | 9.1.1 | GHSA-x2rg-fmcv-crq5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DotNetNuke | DotNetNuke CMS Fixed in 9.1.1 | DotNetNuke CMS Fixed in 9.1.1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- 102213 vdb-entry, x_refsource_BID
- http://www.dnnsoftware.com/community/security/security-center x_refsource_CONFIRM
- http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9822 government-resource