CVE-2017-9822
DNN (aka DotNetNuke) has Remote Code Execution via a cookie
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- Record
CVE-2017-9822- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- Record
CVE-2017-9822- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2018-0710
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- Record
EUVD-2018-0710- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x2rg-fmcv-crq5
DNN (aka DotNetNuke) has Remote Code Execution via a cookie
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- Record
GHSA-x2rg-fmcv-crq5- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
DotNetNuke (DNN) Remote Code Execution Vulnerability
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
- Record
CVE-2017-9822- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- Record
CVE-2017-9822- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-x2rg-fmcv-crq5
DNN (aka DotNetNuke) has Remote Code Execution via a cookie
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
- Record
GHSA-x2rg-fmcv-crq5- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet |
before 9.1.1 | 9.1.1 |
DotNetNuke.CoreNuGet |
before 9.1.1, plus listed versions 6.0.07.0.07.0.6.1217.1.07.1.2 Show 14 moreShow less7.2.0.6137.3.0.4997.3.1.207.4.0.3537.4.1.2807.4.2.2168.0.0.8098.0.1.2398.0.2.48.0.3.58.0.4.2269.0.0.10029.0.1.1429.1.0.367 |
9.1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | DotNetNuke Cookie Deserialization Remote Code Excecution | 2017-07-20 |
| Exploit-DB | DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit) | 2020-04-16 |
| PoC in GitHub | murataydemir/CVE-2017-9822 | 2020-08-28 |
| PoC in GitHub | tranphuc2005/CVE-2017-9822 | 2025-09-15 |
| PoC in GitHub | Tnot123/cve-2017-9822 | 2025-09-30 |
| PoC in GitHub | anhcd05/CVE-2017-9822 | 2026-11-01 |
| Nuclei | DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9822 is a high vulnerability (CVSS 8.8) in Dnnsoftware Dotnetnuke, published July 20, 2017. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.8%, the 99th percentile. Fixed in DotNetNuke.Core 9.1.1.
References
securityfocus.com/bid/102213
dnnsoftware.com/community/security/security-center
packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9822
nvd.nist.gov/vuln/detail/CVE-2017-9822
github.com/advisories/GHSA-x2rg-fmcv-crq5