PT-2019-9183 · Dnn · Dnn

Publicado 2019-07-03 · Atualizado 2023-03-03 · CVE-2018-15812

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DNN (aka DotNetNuke) versions 9.2 through 9.2.1

Description The issue is related to incorrect conversion of encryption key source values, which results in lower than expected entropy.

Recommendations For DNN (aka DotNetNuke) versions 9.2 through 9.2.1, update to a version that correctly handles encryption key source values to prevent lower than expected entropy.

Exploit

Correção

Enumeração de Fraquezas

CWE-331

Identificadores relacionados

CVE-2018-15812

GHSA-PF46-GQG9-J3V3

Produtos afetados

Dnn

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48336 · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/releases · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15812 · Nota de Segurança
• https://dnnsoftware.com/community/security/security-center · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-15812 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pf46-gqg9-j3v3 · Aviso do Fabricante