CVE-2018-15811
Inadequate Encryption Strength in DotNetNuke
CVE-2018-15811 is a high vulnerability (CVSS 7.5) in Dnnsoftware Dotnetnuke, published July 3, 2019. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 76.3%, the 99th percentile. Fixed in DotNetNuke.Core 9.2.2.
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- Record
CVE-2018-15811- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
CVE List
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- Record
CVE-2018-15811- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
EUVDEUVD-2019-0590
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- Record
EUVD-2019-0590- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h595-8pw6-5q6v
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- Record
GHSA-h595-8pw6-5q6v- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H - Weakness
- CWE-326
- Updated
- 2026-11-02
CISA KEV No score
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
- Record
CVE-2018-15811- Weakness
- CWE-326
- Updated
- 2026-11-02
OSV
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- Record
CVE-2018-15811- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-h595-8pw6-5q6v
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- Record
GHSA-h595-8pw6-5q6v- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H - Weakness
- CWE-326
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet |
9.2.0 up to 9.2.2 | 9.2.2 |
DotNetNuke.CoreNuGet |
9.2.0 up to 9.2.2, plus listed versions 9.2.0.3669.2.1.533 |
9.2.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | DotNetNuke Cookie Deserialization Remote Code Excecution | 2017-07-20 |
| Exploit-DB | DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit) | 2020-04-16 |
| Nuclei | DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | exploitation, exploits | |
| 2026-11-02 | created | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV |
References
github.com/dnnsoftware/Dnn.Platform/releases
dnnsoftware.com/community/security/security-center
packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15811
nvd.nist.gov/vuln/detail/CVE-2018-15811