CVE-2017-9822

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Basic Information

CVE State: PUBLISHED
Reserved Date: June 22, 2017
Published Date: July 20, 2017
Last Updated: October 21, 2025
Vendor: DotNetNuke
Product: DotNetNuke CMS Fixed in 9.1.1
Description: DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
Tags

8.8 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Source	Added Date
CISA	2021-11-03 00:00:00 UTC
CISA	2021-11-03 00:00:00 UTC

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb	2025-04-28 15:02:51 UTC
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9822.yaml	2025-04-25 00:00:00 UTC

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

Type: github • Created: 2020-08-28 12:45:44 UTC • Stars: 15

[CVE-2017-9822] DotNetNuke Cookie Deserialization Remote Code Execution (RCE)