Inadequate Encryption Strength in DotNetNuke

HIGH 7.5EXPLOITED (CISA KEV)CVE-2018-18325 · GHSA-j3g9-6fx5-gjv7 · Published 03/07/2019 · updated 17/06/2026

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 9.3.0`	`9.3.0`
dotnetnuke dnnsoftware	`≥ 9.2, ≤ 9.2.2`	No fix yet

Description

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

NVD description

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

References

nvd.nist.gov/vuln/detail/CVE-2018-18325 · ADVISORY
dnnsoftware/Dnn.Platform · PACKAGE
dnnsoftware/Dnn.Platform release · WEB
cisa.gov/known-exploited-vulnerabilities-catalog · WEB
dnnsoftware.com/community/security/security-center · WEB
packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html · WEB
CISA KEV · CVE-2018-18325

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free