Patchfirst
Patchfirst
CVE-2018-15811 KEVPublic exploit High · 7.5 EPSS 76.3%

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke (DNN) · DotNetNuke (DNN)

Summary

DotNetNuke (DNN) versions 9.2 through 9.2.1 contain an inadequate encryption strength flaw, in which a weak encryption algorithm is used to protect input parameters. An attacker with network access can exploit this without authentication or user interaction to compromise the confidentiality of the protected data.

Official description · NVD

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

Breakdown
68.2 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
0/15

First seen exploited 2 years after disclosure. Public exploit code (Metasploit) was available 23 months before disclosure.

  1. Public exploit codeMetasploit23 mo before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees+2 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete once on the same day. The latest fix listed for DotNetNuke.Core is 9.3.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2018-15811DotNetNuke (DNN) Inadequate Encryption Strength3 Jul 2019KEV
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
    • Similar weakness in the same product (machine-matched)same product + CWE + description similarity
    CVE-2018-18325DotNetNuke (DNN) Inadequate Encryption Strength3 Jul 2019KEV

Fixes in DotNetNuke.CoreNuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 8.0.1CVE-2016-711931 Aug 2016
  2. 9.1.1CVE-2017-982220 Jul 2017KEV
  3. 9.2.0CVE-2017-09293 Jul 2018
  4. 9.2.2CVE-2018-158113 Jul 2019KEV
  5. 9.2.2CVE-2018-158123 Jul 2019
  6. 9.3.0CVE-2018-183253 Jul 2019KEV
  7. 9.3.0CVE-2018-183263 Jul 2019Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: DotNetNuke.Core.

NuGetDotNetNuke.CoreGHSA-h595-8pw6-5q6v

Upgrade to 9.3.0 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2018-18325, CVE-2018-18326).

Set the version to 9.3.0 or later in your .csproj.

First fixed in 9.2.2 for CVE-2018-15811.

Affected versions

If you runUpgrade to
9.2.0 up to 9.2.29.3.0first fix for this CVE: 9.2.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag (3 duplicates merged)

Vendor Advisory 1

dnnsoftware.com/community/security/security-center

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15811

Third Party Advisory 1

packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html

Release Notes 1

github.com/dnnsoftware/Dnn.Platform/releases
↑ ↓ chooseEnter openEsc close