GHSA-xx3h-j3cx-8qfj CVE-2018-18326
Insufficient Entropy in DotNetNuke
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 54.27%
- Chance of exploitation in the next 30 days. Higher than 99.01% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-331 Insufficient Entropy
- Fix
9.3.0- Upgrade DotNetNuke.Core to this version or later
Description
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
Affected versions
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| DotNetNuke.Core | < 9.3.0 |
9.3.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
DotNetNuke.Core NuGet → 9.3.0
- dotnet
dotnet add package DotNetNuke.Core --version 9.3.0
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
How to prevent it
- Implementation: Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2018-18325 Inadequate Encryption Strength in DotNetNuke | High Known exploited | Also affects DotNetNuke.Core |
| CVE-2018-15811 Inadequate Encryption Strength in DotNetNuke | High Known exploited | Also affects DotNetNuke.Core |
| GHSA-x2rg-fmcv-crq5 DNN (aka DotNetNuke) has Remote Code Execution via a cookie | High Known exploited | Also affects DotNetNuke.Core |
| GHSA-fcpv-w245-r2q7 DotNetNuke.Core security code analysis rules triggered | Low | Also affects DotNetNuke.Core |
| GHSA-2rhw-gw3f-477j DNN: Same HostGUID for all new installs | Medium | Also affects DotNetNuke.Core |
| GHSA-fpj4-9qhx-5m6m DNN: Force Friend Request Acceptance | Medium | Also affects DotNetNuke.Core |
| GHSA-ffq7-898w-9jc4 DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload | High | Also affects DotNetNuke.Core |
| GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title | Medium | Also affects DotNetNuke.Core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor