CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
DotNetNuke (DNN) Remote Code Execution (RCE) Vulnerability via Weak Encryption Algorithm (CVE-2018-18325)
[Affected Scope] DotNetNuke (DNN) Platform versions 9.2 through 9.2.2.
[Impact] Attackers can bypass security controls due to weak encryption of input parameters, leading to .NET deserialization and Remote Code Execution (RCE) via malicious cookies.
[Mitigation] Immediately upgrade the DNN Platform to version 9.3.0 or higher, and ensure secure machineKey configurations are applied.
DotNetNuke (DNN) Remote Code Execution via Weak Encryption and Cookie Deserialization (CVE-2018-15811)
[Affected Scope] DotNetNuke (DNN) Platform versions 9.2.0 through 9.2.1
[Impact] Attackers can exploit weak cryptographic algorithms to decrypt, forge, and inject malicious serialized .NET payloads into cookies, leading to Remote Code Execution (RCE)
[Mitigation] Immediately upgrade DNN Platform to version 9.2.2 or higher, and regenerate the MachineKey in web.config
DotNetNuke (DNN) Cookie Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2017-9822)
[Affected Scope] All DotNetNuke (DNN) web application servers running versions prior to 9.1.1
[Impact] Attackers can exploit this vulnerability to deserialize arbitrary .NET objects via manipulated cookies, leading to Remote Code Execution (RCE) under the context of the web server
[Mitigation] Immediately upgrade the DNN platform to the latest stable version (9.1.1 or higher) and implement WAF rules to block malicious cookie payloads