CVE-2017-0929 (High) detected in multiple libraries

[mend-bolt-for-github]

CVE-2017-0929 - High Severity Vulnerability

Vulnerable Libraries - DotNetNuke-9.1.1.129.dll, DotNetNuke-7.4.2.216.dll, DotNetNuke-8.0.4.226.dll, DotNetNuke-8.0.3.5.dll

DotNetNuke-9.1.1.129.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.web.mvc.razorpages.sdk.1.0.29.nupkg

Path to vulnerable library: /References/DNN/09.01.01/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-9.1.1.129.dll (Vulnerable Library)

DotNetNuke-7.4.2.216.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.7.4.2.216.nupkg

Path to vulnerable library: /References/DNN/07.04.02/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-7.4.2.216.dll (Vulnerable Library)

DotNetNuke-8.0.4.226.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.8.0.4.226.nupkg

Path to vulnerable library: /References/DNN/08.00.04/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-8.0.4.226.dll (Vulnerable Library)

DotNetNuke-8.0.3.5.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.8.0.3.5.nupkg

Path to vulnerable library: /References/DNN/08.00.03/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-8.0.3.5.dll (Vulnerable Library)

Found in base branch: master

Vulnerability Details

DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.

Publish Date: 2018-07-03

URL: CVE-2017-0929

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0929

Release Date: 2018-05-24

Fix Resolution: 9.2.0

---

Step up your Open Source Security Game with Mend here