PT-2019-9183 · Dnn · Dnn

Published 2019-07-03 · Updated 2023-03-03 · CVE-2018-15812

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DNN (aka DotNetNuke) versions 9.2 through 9.2.1

Description The issue is related to incorrect conversion of encryption key source values, which results in lower than expected entropy.

Recommendations For DNN (aka DotNetNuke) versions 9.2 through 9.2.1, update to a version that correctly handles encryption key source values to prevent lower than expected entropy.

Exploit

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2018-15812

GHSA-PF46-GQG9-J3V3

Affected Products

Dnn

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48336 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15812 · Security Note
• https://dnnsoftware.com/community/security/security-center · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15812 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pf46-gqg9-j3v3 · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform/releases · Note