CVE-2018-18325KEV · OVERDUE

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

High · published July 3, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.5
EPSS
74%
Percentile
99.5
In the wild
Confirmed
What it is

⚡ A weak encryption algorithm in DNN versions 9.2 to 9.2.2 is making sensitive data as secure as a paper lockbox! 🚨 Think of it like using a flimsy cardboard box to store your most prized possessions. Anyone with a little determination can just rip it open and access what’s inside! An attacker could potentially intercept and manipulate sensitive input parameters, leading to unauthorized access or data breaches. It's like leaving your house key under the doormat – sure, it’s convenient for you, but it’s an open invitation for mischief!

Put simply

Think of it like using a flimsy cardboard box to store your most prized possessions. Anyone with a little determination can just rip it open and access what’s inside! This vulnerability arises from the use of a weak encryption algorithm to protect input parameters in DNN, making it easier for attackers to exploit and gain access to critical data.

What to do

An attacker could potentially intercept and manipulate sensitive input parameters, leading to unauthorized access or data breaches. It's like leaving your house key under the doormat – sure, it’s convenient for you, but it’s an open invitation for mischief! To protect against this vulnerability, upgrade DNN to version 9.2.3 or later immediately. Additionally, review encryption practices and consider implementing stronger encryption techniques to safeguard data more effectively. You’ve got this! Take these steps and you’ll fortify your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.74048 · 99.5th percentile
Published
2019-07-03T16:37Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 03 JUL 16:37Z
    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters
    cvelistv5