CVE-2018-18326 - DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting

CVE-2018-18326

Summary

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

References

Vulnerable Configurations

cpe:2.3:a:dnnsoftware:dotnetnuke:9.2:*:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2:*:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.0:*:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.0:*:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.1:-:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.1:-:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.1:rc0:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.1:rc0:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.1:rc1:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.1:rc1:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:-:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:-:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc0:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc0:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc1:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc1:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc2:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc2:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc3:*:*:*:*:*:*
cpe:2.3:a:dnnsoftware:dotnetnuke:9.2.2:rc3:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 03-03-2023 - 20:46)
Impact:
Exploitability:

CWE

CWE-331

CAPEC

Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

misc

Last major update

03-03-2023 - 20:46

Published

03-07-2019 - 17:15

Last modified

03-03-2023 - 20:46