PT-2018-3765 · Dnn · Dnn

Publicado 2018-10-01 · Atualizado 2023-03-03 · CVE-2018-18325

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions DNN (aka DotNetNuke) versions 9.2 through 9.2.2

Description The issue is related to the use of a weak encryption algorithm to protect input parameters, which could allow a remote attacker to gain unauthorized access to protected information. This problem exists due to an incomplete fix for a previous issue.

Recommendations For DNN (aka DotNetNuke) versions 9.2 through 9.2.2, consider updating to a version that uses a stronger encryption algorithm to protect input parameters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

BDU:2021-05679

CVE-2018-18325

GHSA-J3G9-6FX5-GJV7

Produtos afetados

Dnn

Referências · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48336 · Exploit
• https://github.com/dnnsoftware/Dnn.Platform · Nota
• https://github.com/dnnsoftware/Dnn.Platform/releases · Nota
• https://bdu.fstec.ru/vul/2021-05679 · Nota de Segurança
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18325 · Nota de Segurança
• https://dnnsoftware.com/community/security/security-center · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j3g9-6fx5-gjv7 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18325 · Nota
• https://osv.dev/vulnerability/CVE-2018-18325 · Aviso do Fabricante