CVE-2018-18325 KEVPublic exploit High · 7.5 EPSS 74.0%

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

Summary

DotNetNuke (DNN) versions 9.2 through 9.2.2 contain a flaw in which input parameters are protected with a weak encryption algorithm. An attacker with network access can exploit this without authentication or user interaction, and the impact is limited to confidentiality exposure of the protected parameters.

Official description · NVD

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

Breakdown

68.1 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Capture network trafficT1040 · Network SniffingAI-written (claude-haiku-5-5)Medium confidence9 general detection rules

First seen exploited 2 years after disclosure. Public exploit code (Metasploit) was available 23 months before disclosure.

Public exploit codeMetasploit20 Jul 201723 mo before
Disclosed3 Jul 2019day 0
First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees3 Nov 2021+2 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete once on the same day. The latest fix listed for DotNetNuke.Core is 9.5.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2018-15811DotNetNuke (DNN) Inadequate Encryption Strength3 Jul 2019KEV
incomplete fixHigh
Why these are linked:
- Stated in the CVE textNOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
This CVECVE-2018-18325DotNetNuke (DNN) Inadequate Encryption Strength3 Jul 2019KEV

Fixes in DotNetNuke.CoreNuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

9.2.0CVE-2017-09293 Jul 2018
9.2.2CVE-2018-158113 Jul 2019KEV
9.2.2CVE-2018-158123 Jul 2019
9.3.0CVE-2018-183253 Jul 2019KEV
9.3.0CVE-2018-183263 Jul 2019
9.4.0CVE-2019-1256226 Sep 2019
9.5.0CVE-2020-518724 Feb 2020Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Remote web app exploited via weak encryption

uses a weak encryption algorithm to protect input parameters

From the official description (NVD) Original ↗

Credential AccessTA0006

Network Sniffing T1040 Medium also Discovery

AI mapping from the description · primary impact

Weak crypto lets attacker decrypt traffic

uses a weak encryption algorithm to protect input parameters

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 158 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-18325 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Network SniffingT10409 general rules

Cisco Sniffingmediumtest
Harvesting Of Wifi Credentials Via Netsh.EXEmediumtest
New Network Trace Capture Started Via Netsh.EXEmediumtest
PktMon.EXE Executionmediumtest
Potential Network Sniffing Activity Using Network Toolsmediumtest
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlockmediumtest
Windows Pcap Driversmediumtest
Network Sniffing - Linuxlowtest

All 9 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: DotNetNuke.Core.

NuGetDotNetNuke.CoreGHSA-j3g9-6fx5-gjv7

Upgrade to 9.3.0 or later

Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2015-2794, CVE-2017-0929, +3).

Set the version to 9.3.0 or later in your .csproj.

The first fix for CVE-2018-18325.

Affected versions

If you run	Upgrade to
All versions before 9.3.0	9.3.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

4 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2019-0595

DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)EDB-48336 · remote · windows · 2020-04-16 · verified

, 30 Oct 2026

74.0%Top 0.52%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.48%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1823 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9948 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total68.1

Record

Published: 3 Jul 2019
Modified: 17 Jun 2026
: CWE-326 Inadequate Encryption Strength
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in DotNetNuke.CoreNuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

Credential AccessTA0006

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 1

Release Notes 1

How attackers get in

What they do

techniques