Description

DNN (DotNetNuke) CMS is a .NET content management system.

DNN uses usafe deserialization for a DNNPersonalization cookie. Arbitrary object deserialization is inherently unsafe, and should never be performed on untrusted data. An attacker can leverage this vulnerability to execute arbitrary code on the system.

Remediation

Upgrade to the latest version of DNN

References

Security Center

ysoserial.net

Related Vulnerabilities

Oracle Access Manager 'opensso' Deserialization RCE (CVE-2021-35587)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-11111)

.NET HTTP Remoting publicly exposed

Kentico CMS Deserialization RCE

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.27)

Severity

High

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Insecure Deserialization Acumonitor