CVE-2018-15811highunder attackCWE-326

CVE-2018-15811

Published · Updated

Follow this CVE+ Monitor DotNetNuke+ Monitor DotNetNuke.Core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 76%
from disclosure to weapon288 days
Published on NVDJul 3
1st PoC+288d
metasploitJul 20
CISA KEV+854d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

DNN (DotNetNuke) versions 9.2 to 9.2.1 use weak encryption to protect user input parameters, making it possible for attackers to decrypt and tamper with sensitive data in transit.

Technical detail

CWE-326: DNN 9.2-9.2.1 implements insufficient cryptographic strength for parameter encryption, allowing an attacker with network access to potentially recover plaintext from encrypted parameters. The weak algorithm reduces the effective security strength of the encryption mechanism, enabling feasible cryptanalysis attacks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.