exploit/windows/http/dnn_cookie_deserialization_rce

weaponized

DotNetNuke Cookie Deserialization Remote Code Excecution

view exploit source metasploittype exploitpublished 2017-07-20catalog metasploit

exploited CVEs (5)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-18326US	high7.5	54.3% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete…
CVE-2018-18325US	high7.5OT critical	74.0% (99th)	KEV	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
CVE-2018-15812US	high7.5	47.2% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVE-2018-15811US	high7.5OT critical	76.3% (100th)	KEV	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
CVE-2017-9822US	high8.8OT critical	94.8% (100th)	KEV	2017-07-20
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.