CVE-2017-9822 DotNetNuke (DNN) Remote Code Execution

What is CVE-2017-9822?

CVE-2017-9822 is a high-severity unsafe deserialization vulnerability in Dnnsoftware Dotnetnuke, published on 20 Jul 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Weakness: CWE-94

Which versions are affected by CVE-2017-9822?

2 open source packages ship an affected version, including DotNetNuke.Core. It affects 1 product.

Products include Dnnsoftware Dotnetnuke.

How do I fix CVE-2017-9822?

Upgrade DotNetNuke.Core to 9.1.1 or later. US federal agencies must fix it by 3 May 2022.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-9822 being exploited?

Yes. Attackers have exploited CVE-2017-9822 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in Dnnsoftware Dotnetnuke

• CVE-2018-15811 DotNetNuke (DNN) Inadequate Encryption Strength Exploited High 7.5
• CVE-2018-18325 DotNetNuke (DNN) Inadequate Encryption Strength Exploited High 7.5
• CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite Critical 10.0
• CVE-2006-3601 Privilege escalation in n/a Critical 10.0
• CVE-2015-2794 The installation wizard in DotNetNuke (DNN) allows privilege escalation Critical 9.8

All Dnnsoftware Dotnetnuke vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x2rg-fmcv-crq5.