PT-2019-9576 · Dnn · Dnn

CVE-2018-18326 · Publicado 2019-07-03 · Atualizado 2023-03-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DNN (aka DotNetNuke) versions 9.2 through 9.2.2

Description The issue is related to incorrect conversion of encryption key source values, resulting in lower than expected entropy. This problem exists due to an incomplete fix for a previous issue.

Recommendations For versions 9.2 through 9.2.2, update to a version that fully addresses the incomplete fix to ensure proper encryption key source value conversion and adequate entropy.

Exploit

Correção

Enumeração de Fraquezas

CWE-331

Identificadores relacionados

CVE-2018-18326

GHSA-XX3H-J3CX-8QFJ

Produtos afetados

Dnn

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48336 · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/releases · Nota
• https://osv.dev/vulnerability/CVE-2018-18326 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xx3h-j3cx-8qfj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18326 · Nota de Segurança
• https://dnnsoftware.com/community/security/security-center · Aviso do Fabricante