VulnerabilityModified
CVE-2018-9126
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
CRITICAL 9.8EPSS 49.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 49.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 49.55% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- zldnn/dnnarticle
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/146999/DotNetNuke-DNNarticle-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44414/Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/146999/DotNetNuke-DNNarticle-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44414/Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.