CVE-2018-15811: DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters

High severity · published Jul 3, 2019

CVE-2018-15811

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters

In wildKEV

7.5

CVSS

76.3%

EPSS

Yes

On KEV

Description

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)76.3% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueMay 3, 2022

Ransomware campaign useNot known

Affected products

Which versions

Dotnetnuke · Dnnsoftware

9.2 through 9.2.1 · source: NVD

DotNetNuke (DNN) · DotNetNuke (DNN)

All versions, or not specified · source: KEV

Affected product

Dotnetnuke

Dnnsoftware

All Dotnetnuke CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-15811

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-15811

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit

http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html

Release Notes

https://github.com/dnnsoftware/Dnn.Platform/releases

Vendor Advisory

https://www.dnnsoftware.com/community/security/security-center

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15811