PT-2019-9576 · Dnn · Dnn

Published 2019-07-03 · Updated 2023-03-03 · CVE-2018-18326

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DNN (aka DotNetNuke) versions 9.2 through 9.2.2

Description The issue is related to incorrect conversion of encryption key source values, resulting in lower than expected entropy. This problem exists due to an incomplete fix for a previous issue.

Recommendations For versions 9.2 through 9.2.2, update to a version that fully addresses the incomplete fix to ensure proper encryption key source value conversion and adequate entropy.

Exploit

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2018-18326

GHSA-XX3H-J3CX-8QFJ

Affected Products

Dnn

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48336 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18326 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xx3h-j3cx-8qfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18326 · Security Note
• https://dnnsoftware.com/community/security/security-center · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform/releases · Note