This past month, we’ve seen a wave of attacks targeting DNN Platform and Evoq Sites. Mitchel Sellers has summarized them in his blog.

Vulnerabilities found across the entire ecosystem; including:

• DNN Extensions (Modules & Themes) of multiple vendors
• Third-party component suite that is used within DNN Products
• DNN Platform

Timeline

6th, 2017 – Our team becomes aware of a vulnerability in our Live Forms module. Immediately, we mobilized a team to internally audit all our products for any other vulnerabilities. All identified products were immediately patched.

June 9th, 2017 – Our team sends the “Critical Security Update” email to all customers that purchased any of the affected product(s) requesting them to immediately upgrade or apply the temporary fix.

June 21st, 2017 – DNN provides the security patch for vulnerability in third-party component suite that is used within DNN Products.

June 27th, 2017 – DNN Store sends an email to all Mandeeps.com customers with a copy of the email that was sent by Mandeeps.com on June 9th.

June 27th, 2017 – DNN Store sends an email to all DNN Go customers. Refer to Mitchel Sellers blog for details.

June 30th, 2017 – DNN Store sends an email to Easy DNN Solutions customers. Refer to Mitchel Sellers blog for details.

July 5th, 2017 – Mandeeps.com releases Live Helpdesk v1.3.5 to patch a critical vulnerability.

July 5th, 2017 – DNN 9.1.1 is released addressing several security issues.

Is your site secure?

1. Upgrade to DNN 9.1.1
   Be sure to manually apply the “Fix(s) for issue” if you cannot immediately upgrade to DNN 9.1.1.
   Refer to DNN 9.1.1 Security Bulletin


2. Upgrade Mandeeps.com Products
   Make sure you’re running the following version (or greater) of our products:

   Live Campaign v3.9.7
   Live Content v6.1.0
   Live Forms v4.3.2
   Live Helpdesk v1.3.5
   Live Utilities v1.1.2
   Common Library v2.1.8
   Porto 3.3.1

   If you cannot upgrade right away for any reason then please contact our Support Team for a temporary fix.

3. Contact DNNGo or EasyDNNSolutions if you’re running any of their products for assistance or refer to Mitchel Sellers blog mitigation instructions.