CVEブラウザに戻る

CVE-2018-18325

Known Exploited (CISA KEV)HIGH

7.5

CVSS Severity Score

EPSS Score66.6310%

EPSS Percentile94.23th

Published2019年7月3日

Last Modified2025年11月7日

Vulnerability Description

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

Affected Platforms (CPE)

📦

Dnnsoftware

Dotnetnuke

>= 9.2 and <= 9.2.2

References & Advisories

🔗 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html

🔗 https://github.com/dnnsoftware/Dnn.Platform/releases

🔗 https://www.dnnsoftware.com/community/security/security-center

🔗 http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html

🔗 https://github.com/dnnsoftware/Dnn.Platform/releases

🔗 https://www.dnnsoftware.com/community/security/security-center

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18325

関連する脆弱性情報

CVE-2006-360110.0

** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attack...

CVE-2015-27949.8

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser a...

CVE-2019-193929.8

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new ...

CVE-2018-91269.8

The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently disco...