CVE-2019-19392 - The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data

Back Back to CVE browser

CRITICAL

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data

Published Jan 21, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.39%

Description

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (3)

https://blog.joaoorvalho.com/description-cve-2019-19392/
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9013
Advisory
https://github.com/fordnn/usersexportimport/commits/master
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://blog.joaoorvalho.com/description-cve-2019-19392/		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9013		Advisory
https://github.com/fordnn/usersexportimport/commits/master		x_refsource_MISCThird Party Advisory