Exploited vulnerability

CVE-2018-18325

TLP:CLEAR

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.

Facts

Vendor: DotNetNuke (DNN)
Product: DotNetNuke (DNN)
CVSS: 7.5
EPSS (probability of exploitation within 30 days): 74 %
On CISA's Known Exploited Vulnerabilities list since: 3 November 2021
First known exploitation: 3 November 2021
CISA's deadline for US federal agencies: 3 May 2022
Weakness: CWE-326
First seen by Risk Letters: 3 November 2021

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD