Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation

Dynamicweb contains a vulnerability which allows an unauthenticated attacker to create a new administrative user. id: CVE-2022-25369 info: name: Dynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User Creation author: pdteam severity: critical description: Dynamicweb contains a vulnerability which...

CVE-2022-25369

Dynamicweb versions 9.5.0 through 9.12.7 are vulnerable to a logic flaw that allows an unauthenticated attacker to create a new administrative user via the unprotected Default.aspx endpoint. By exploiting this logic issue, which relates to how the product determines if setup phases can be re-run,...

CVE-2022-25369

creationtimestamp| type| source ---|---|--- 2022-02-25 11:05:15+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5488 2025-06-04 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-06-04 2025-06-06 00:00:00+00:00| exploited| The...