Yes. DNN Platform is a free, open-source CMS under the MIT License.

What is the tech stack for DNN?

DNN runs on ASP.NET (.NET Framework 4.8+) with Microsoft SQL Server (2017+ or Azure SQL).

DNN Platform is community-led and a member project of the .NET Foundation.

What’s the difference between DNN and Evoq?

DNN Platform is the open-source core that's been wildly popular and adopted for over 20 years. Evoq is a commercial offering maintained by DNN Software (IgniteTech) that builds on DNN.

DNN Forums

Ask questions about your website to get help learning DNN and help resolve issues.

Security issue DNN 7

3 Replies

1 Subscribed to this topic

40 Subscribed to this forum

Sort:

Author

Messages

Alexandru Ionescu

New Around Here

Posts: 13

7/23/2020 9:11 AM

Hello,

We have a installation of DNN Platform (Version: 07.03.03 (118)) and our security auditor found a remote code execution (RCE) vulnerability that allows an unauthenticated attacker to execute arbitrary commands (with server privileges). This is due to an outdated Telerik Version (Telerik Web UI 2013.2.717.40). The issue got CVE-2017-9248 and details can be viewed here: https://nvd.nist.gov/vuln/detail/CVE-2017-9248

Is there a way to update/upgrade telerik without upgrading the DNN in order to avoid that vulnerability?

Timo Breumelhof.

Senior Member

Posts: 1322

Helpful Replier

Lifesaver

New Poster

Engaged Reader

7/23/2020 9:41 AM

Posted By Alexandru Ionescu on 23 Jul 2020 09:11 AM
Hello,

We have a installation of DNN Platform (Version: 07.03.03 (118)) and our security auditor found a remote code execution (RCE) vulnerability that allows an unauthenticated attacker to execute arbitrary commands (with server privileges). This is due to an outdated Telerik Version (Telerik Web UI 2013.2.717.40). The issue got CVE-2017-9248 and details can be viewed here: https://nvd.nist.gov/vuln/detail/CVE-2017-9248

Is there a way to update/upgrade telerik without upgrading the DNN in order to avoid that vulnerability?

You should really upgrade to DNN 9.
This security vulnerability is not the only issue found since DNN 7 came out.
And yes you can install newer Telerik DLLs but you will still have the other issues found in DNN 7 to worry about.

Mitchel Sellers

Advanced Member

Posts: 132

Helpful Replier

MVP

Engaged Reader

Avid Reader

7/24/2020 12:46 PM

Two additional notes.

1.) Per the security policy please do not post details of security issues here in the forum. But direct questions to [email protected]

2.) Upgrading Telerik is actually not easily possible without hundreds of code changes, including a fork to the DNN project due to breaking changes. You will additionally need your own license

Alexandru Ionescu

New Around Here

Posts: 13

7/27/2020 3:00 AM

Thank you so much.
Should the client buy new licenses for upgrade?
Do you have any ideas about how long will it take?

These Forums are for the discussion of the open source CMS DNN platform and ecosystem.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

If you have (suspected) security issues, please DO NOT post them in the forums but instead follow the official DNN security policy.
No Advertising. This includes the promotion of commercial and non-commercial products or services which are not directly related to DNN.
No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
No Flaming or Trolling.
No Profanity, Racism, or Prejudice.
Site Moderators have the final word on approving / removing a thread or post or comment.
English language posting only, please.

Would you like to help us?

Awesome! Simply post in the forums using the link below and we'll get you started.

Get Involved