CVE-2017-9822 (High) detected in multiple libraries

[mend-bolt-for-github]

CVE-2017-9822 - High Severity Vulnerability

Vulnerable Libraries - DotNetNuke-9.1.1.129.dll, DotNetNuke-7.4.2.216.dll, Microsoft.ApplicationBlocks.Data-2.0.0.0.dll, DotNetNuke-8.0.4.226.dll, DotNetNuke-8.0.3.5.dll

DotNetNuke-9.1.1.129.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.web.mvc.razorpages.sdk.1.0.29.nupkg

Path to vulnerable library: /References/DNN/09.01.01/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-9.1.1.129.dll (Vulnerable Library)

DotNetNuke-7.4.2.216.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.7.4.2.216.nupkg

Path to vulnerable library: /References/DNN/07.04.02/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-7.4.2.216.dll (Vulnerable Library)

Microsoft.ApplicationBlocks.Data-2.0.0.0.dll

Library home page: https://api.nuget.org/packages/dnnmodule.1.0.0.nupkg

Path to vulnerable library: /References/DNN/08.00.03/Microsoft.ApplicationBlocks.Data.dll,/References/DNN/08.00.04/Microsoft.ApplicationBlocks.Data.dll,/References/DNN/07.04.02/Microsoft.ApplicationBlocks.Data.dll,/References/DNN/09.02.02/Microsoft.ApplicationBlocks.Data.dll,/References/DNN/09.01.01/Microsoft.ApplicationBlocks.Data.dll

Dependency Hierarchy:

• ❌ Microsoft.ApplicationBlocks.Data-2.0.0.0.dll (Vulnerable Library)

DotNetNuke-8.0.4.226.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.8.0.4.226.nupkg

Path to vulnerable library: /References/DNN/08.00.04/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-8.0.4.226.dll (Vulnerable Library)

DotNetNuke-8.0.3.5.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.8.0.3.5.nupkg

Path to vulnerable library: /References/DNN/08.00.03/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-8.0.3.5.dll (Vulnerable Library)

Found in HEAD commit: 99eddc879984576ef8d3c958e11d5862bf2924c3

Found in base branch: master

Vulnerability Details

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Publish Date: 2017-07-20

URL: CVE-2017-9822

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-9822

Release Date: 2017-07-20

Fix Resolution: 9.1.1

---

Step up your Open Source Security Game with Mend here