An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have added, it is possible to upload an executable file and achieve command execution. This is fixed in 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9.8, 9.10.18, 9.12.8, and 9.13.0 (and later).

According to its self-reported version number, Dynamicweb is prior to 9.12.8. It is, therefore, affected by an authentication bypass vulnerability due to a logic issue when determining if the setup phases of the product can be run again, allowing an unauthenticated attacker to add a new administrator user. Once authenticated as this administrator, an attacker can upload an executable file and achieve command execution.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115743	Dynamicweb 9.11.x / 9.12.x < 9.12.8 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical
115742	Dynamicweb 9.10.x < 9.10.18 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical
115741	Dynamicweb 9.9.x < 9.9.8 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical
115740	Dynamicweb 9.8.x < 9.8.11 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical
115739	Dynamicweb 9.7.x < 9.7.8 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical
115738	Dynamicweb 9.6.x < 9.6.16 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical
115737	Dynamicweb < 9.5.9 Authentication Bypass	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2022-25369

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical