CVE-2021-40186

The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, allowing a range of possible attacks. In the most common scenario, the attacker exploits SSRF vulnerabilities to attack systems behind the firewall and access sensitive information from Cloud Provider metadata services.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://appcheck-ng.com/dnn-cms-server-side-request-forgery-cve-2021-40186	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*

History

09 Jun 2022, 17:07

Type	Values Removed	Values Added
CWE		CWE-918
CPE		cpe:2.3:a:dnnsoftware:dotnetnuke::::::::
First Time		Dnnsoftware Dnnsoftware dotnetnuke
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 7.5
References	~~(MISC) https://appcheck-ng.com/dnn-cms-server-side-request-forgery-cve-2021-40186 -~~	(MISC) https://appcheck-ng.com/dnn-cms-server-side-request-forgery-cve-2021-40186 - Exploit, Third Party Advisory

02 Jun 2022, 14:53

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-06-02 14:15

Updated : 2023-12-10 14:22

NVD link : CVE-2021-40186

Mitre link : CVE-2021-40186

CVE.ORG link : CVE-2021-40186

JSON object : View

Products Affected

dnnsoftware

dotnetnuke

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2021-40186", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "info@appcheck-ng.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-06-02T14:15:29.597", "references": [{"url": "https://appcheck-ng.com/dnn-cms-server-side-request-forgery-cve-2021-40186", "tags": ["Exploit", "Third Party Advisory"], "source": "info@appcheck-ng.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Secondary", "source": "info@appcheck-ng.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, allowing a range of possible attacks. In the most common scenario, the attacker exploits SSRF vulnerabilities to attack systems behind the firewall and access sensitive information from Cloud Provider metadata services."}, {"lang": "es", "value": "El equipo de investigaci\u00f3n de AppCheck identific\u00f3 una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) dentro de la plataforma DNN CMS, anteriormente conocida como DotNetNuke. Las vulnerabilidades de tipo SSRF permiten al atacante explotar el sistema de destino para realizar peticiones de red en su nombre, permitiendo una serie de posibles ataques. En el escenario m\u00e1s com\u00fan, el atacante aprovecha las vulnerabilidades de tipo SSRF para atacar sistemas detr\u00e1s del firewall y acceder a informaci\u00f3n confidencial de los servicios de metadatos del proveedor de la nube"}], "lastModified": "2022-06-09T17:07:02.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "451B2E1B-6C7D-4A9E-BB5A-C08D806F35F0", "versionEndIncluding": "9.10.2"}], "operator": "OR"}]}], "sourceIdentifier": "info@appcheck-ng.com"}