CVE-2008-6540

DotNetNuke Default Machine Key Exposure

5.1 MediumPublic exploitFix available

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.

Exploit likelihood

2.48%Down 4.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.1

Record: CVE-2008-6540
CVSS 2.0: 5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-6540
Updated: 2026-11-02

EUVDEUVD-2022-4007 No score

Record: EUVD-2022-4007
Updated: 2026-11-03

GitHub AdvisoriesGHSA-grw3-hjjm-5cjm No score

DotNetNuke Default Machine Key Exposure

Record: GHSA-grw3-hjjm-5cjm
Weakness: CWE-453
Updated: 2026-11-02

OSVGHSA-grw3-hjjm-5cjm No score

DotNetNuke Default Machine Key Exposure

Record: GHSA-grw3-hjjm-5cjm
Weakness: CWE-453
Updated: 2026-11-02

Affected products

dnnsoftware dotnetnuke

Affected packages

Affected packages
Package	Affected	Fixed
`DotNetNuke.Core` NuGet	before 4.8.2	4.8.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	DotNetNuke 4.8.1 - Default 'ValidationKey' and 'DecriptionKey' Weak Encryption	2008-03-21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-6540 is a medium vulnerability (CVSS 5.1) in Dnnsoftware Dotnetnuke, published March 30, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in DotNetNuke.Core 4.8.2.