GHSA-h595-8pw6-5q6v GHSA-h595-8pw6-5q6v
Inadequate Encryption Strength in DotNetNuke
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 76.30%
- Chance of exploitation in the next 30 days. Higher than 99.54% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog
- Weakness
- CWE-326 Inadequate Encryption Strength
- Fix
9.2.2- Upgrade DotNetNuke.Core to this version or later
Description
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Affected versions
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| DotNetNuke.Core | >= 9.2.0, < 9.2.2 |
9.2.2 |
| DotNetNuke.Core | >= 9.2.0, < 9.2.2 |
9.2.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
DotNetNuke.Core NuGet → 9.2.2
- dotnet
dotnet add package DotNetNuke.Core --version 9.2.2
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
- Exploit maturity
- H
Weakness
CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
How to prevent it
- Architecture and Design: Use an encryption scheme that is currently considered to be strong by experts in the field.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2018-18325 Inadequate Encryption Strength in DotNetNuke | High Known exploited | Also affects DotNetNuke.Core |
| GHSA-x2rg-fmcv-crq5 DNN (aka DotNetNuke) has Remote Code Execution via a cookie | High Known exploited | Also affects DotNetNuke.Core |
| GHSA-fcpv-w245-r2q7 DotNetNuke.Core security code analysis rules triggered | Low | Also affects DotNetNuke.Core |
| GHSA-2rhw-gw3f-477j DNN: Same HostGUID for all new installs | Medium | Also affects DotNetNuke.Core |
| GHSA-fpj4-9qhx-5m6m DNN: Force Friend Request Acceptance | Medium | Also affects DotNetNuke.Core |
| GHSA-ffq7-898w-9jc4 DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload | High | Also affects DotNetNuke.Core |
| GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title | Medium | Also affects DotNetNuke.Core |
| GHSA-vm5q-8qww-h238 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal | Medium | Also affects DotNetNuke.Core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor