Description
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
DotNetNuke Cookie Deserialization Remote Code Excecution
exploit/windows/http/dnn_cookie_deserialization_rce
Exploit-DB 1
- DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit) EDB-48336 · remote · Apr 16, 2020 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization http/cves/2018/CVE-2018-18325.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | DotNetNuke.Core | < 9.3.0 | 9.3.0 | GHSA-j3g9-6fx5-gjv7 |