Privilege Escalation

Affecting dotnetnuke.core package, versions [,7.4.1)

Do your applications use this vulnerable package? Test your applications

Overview

dotnetnuke.core is an open source web application framework.

Affected versions of this package are vulnerable to Privilege Escalation. An attacker could reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

Remediation

Upgrade dotnetnuke.core to version 7.4.1 or higher.

References

CVSS Score

9.8
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE
CVE-2015-2794
CWE
CWE-265
Snyk ID
SNYK-DOTNET-DOTNETNUKECORE-60264
Disclosed
06 Feb, 2017
Published
05 Aug, 2018