CVE-2018-18326 - DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy

Back Back to CVE browser

HIGH

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy

Published Jul 3, 2019

7.5

HIGH

CVSS 3.1

EPSS 54.27%

Description

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-331

References (5)

http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-xx3h-j3cx-8qfj
Advisory
https://github.com/dnnsoftware/Dnn.Platform/releases
x_refsource_MISCRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-18326
https://www.dnnsoftware.com/community/security/security-center
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-xx3h-j3cx-8qfj		Advisory
https://github.com/dnnsoftware/Dnn.Platform/releases		x_refsource_MISCRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-18326
https://www.dnnsoftware.com/community/security/security-center		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 3, 2019

Updated Aug 5, 2024

Reserved Oct 15, 2018

Link CVE-2018-18326

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-18326

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-18326

GHSA-XX3H-J3CX-8QFJ