{"id":"CVE-2018-15812","published":"2019-07-03T16:35:30Z","modified":"2024-08-05T10:01:54Z","title":"DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than…","vendor":null,"product":null,"tier":"tail","description":{"text":"DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.47194,"percentile":0.98835,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/dnnsoftware/Dnn.Platform/releases","tags":["x_refsource_MISC"]},{"url":"https://www.dnnsoftware.com/community/security/security-center","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"priority":{"score":24.8,"factors":[{"name":"EPSS percentile","points":19.77},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-04-16"},"metasploit":[{"name":"DotNetNuke Cookie Deserialization Remote Code Excecution","module":"exploit/windows/http/dnn_cookie_deserialization_rce","type":"exploit","disclosureDate":"2017-07-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb"}],"first":{"date":"2017-07-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb"},"provenance":"source"},"affected":[{"ecosystem":"NuGet","package":"DotNetNuke.Core","vulnerableRanges":[">=9.2.0, <9.2.2"],"patched":["9.2.2"],"from":["GHSA-pf46-gqg9-j3v3"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0600","exploited":false,"provenance":"source"},"exploits":[{"id":48336,"url":"https://www.exploit-db.com/exploits/48336","title":"DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)","date":"2020-04-16","verified":true,"provenance":"source"}],"exploitRefs":["http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html"],"lineage":{"familyId":"fam-dotnetnuke-core-cve-2018-15812","children":[{"from":"CVE-2018-15812","to":"CVE-2018-18326","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.","from":"CVE.org","in":"CVE-2018-18326"},{"kind":"version-step","provenance":"source","package":"NuGet:DotNetNuke.Core","fromFixed":"9.2.2","toFixed":"9.3.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.93,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-9822","published":"2017-07-20","fixed":"9.1.1","kev":true},{"cve":"CVE-2017-0929","published":"2018-07-03","fixed":"9.2.0","kev":false,"link":{"from":"CVE-2017-0929","to":"CVE-2018-15812","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:DotNetNuke.Core","fromFixed":"9.2.0","toFixed":"9.2.2","daysApart":365}]}},{"cve":"CVE-2018-15811","published":"2019-07-03","fixed":"9.2.2","kev":true},{"cve":"CVE-2018-15812","published":"2019-07-03","fixed":"9.2.2","kev":false},{"cve":"CVE-2018-18325","published":"2019-07-03","fixed":"9.3.0","kev":true,"link":{"from":"CVE-2018-15812","to":"CVE-2018-18325","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:DotNetNuke.Core","fromFixed":"9.2.2","toFixed":"9.3.0","daysApart":0}]}},{"cve":"CVE-2018-18326","published":"2019-07-03","fixed":"9.3.0","kev":false},{"cve":"CVE-2019-12562","published":"2019-09-26","fixed":"9.4.0","kev":false}],"package":"NuGet:DotNetNuke.Core"}}