Privilege Escalation

Affecting dotnetnuke.core package, versions [,7.4.1)

high severity

Overview

dotnetnuke.core is an open source web application framework.

Affected versions of this package are vulnerable to Privilege Escalation. An attacker could reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

Remediation

Upgrade dotnetnuke.core to version 7.4.1 or higher.

References

Do your applications use this vulnerable package?

CVE
CVE-2015-2794
CWE
CWE-265
Snyk ID
SNYK-DOTNET-DOTNETNUKECORE-60264
Disclosed
06 Feb, 2017
Published
05 Aug, 2018