CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

High severity · published Jul 3, 2019

CVE-2018-18325

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

In wildKEV

7.5

CVSS

74%

EPSS

Yes

On KEV

Description

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)74.0% · higher than 99% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueMay 3, 2022

Ransomware campaign useNot known

Affected products

Which versions

Dotnetnuke · Dnnsoftware

9.2 through 9.2.2 · source: NVD

DotNetNuke (DNN) · DotNetNuke (DNN)

All versions, or not specified · source: KEV

Affected product

Dotnetnuke

Dnnsoftware

All Dotnetnuke CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-18325

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-18325

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

x_refsource_MISC

https://github.com/dnnsoftware/Dnn.Platform/releases

x_refsource_MISC

https://www.dnnsoftware.com/community/security/security-center

x_refsource_MISC

http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html