CVE-2018-18325highunder attackCWE-326

CVE-2018-18325

Published · Updated

Follow this CVE+ Monitor DotNetNuke+ Monitor DotNetNuke.Core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 74%
from disclosure to weapon288 days
Published on NVDJul 3
1st PoC+288d
metasploitJul 20
CISA KEV+854d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

DNN (DotNetNuke) versions 9.2 to 9.2.2 use weak encryption to protect input parameters, making it easier for attackers to decrypt and manipulate sensitive data sent between the application and users.

Technical detail

CWE-326 identifies inadequate encryption strength in parameter protection. Attackers can intercept and decrypt input parameters due to weak cryptographic algorithms, potentially leading to parameter manipulation and unauthorized access. This is a regression from an incomplete remediation of CVE-2018-15811.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.