CVE-2018-18325
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Record
CVE-2018-18325- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
CVE List
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Record
CVE-2018-18325- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
EUVDEUVD-2019-0595
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Record
EUVD-2019-0595- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j3g9-6fx5-gjv7
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Record
GHSA-j3g9-6fx5-gjv7- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H - Weakness
- CWE-326
- Updated
- 2026-11-02
CISA KEV No score
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
- Record
CVE-2018-18325- Weakness
- CWE-326
- Updated
- 2026-11-02
OSV
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Record
CVE-2018-18325- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-j3g9-6fx5-gjv7
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- Record
GHSA-j3g9-6fx5-gjv7- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H - Weakness
- CWE-326
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet |
before 9.3.0 | 9.3.0 |
DotNetNuke.CoreNuGet |
before 9.3.0, plus listed versions 6.0.07.0.07.0.6.1217.1.07.1.2 Show 17 moreShow less7.2.0.6137.3.0.4997.3.1.207.4.0.3537.4.1.2807.4.2.2168.0.0.8098.0.1.2398.0.2.48.0.3.58.0.4.2269.0.0.10029.0.1.1429.1.0.3679.1.1.1299.2.0.3669.2.1.533 |
9.3.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | DotNetNuke Cookie Deserialization Remote Code Excecution | 2017-07-20 |
| Exploit-DB | DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit) | 2020-04-16 |
| Nuclei | DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-18325 is a high vulnerability (CVSS 7.5) in Dnnsoftware Dotnetnuke, published July 3, 2019. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.0%, the 99th percentile. Fixed in DotNetNuke.Core 9.3.0.
References
github.com/dnnsoftware/Dnn.Platform/releases
dnnsoftware.com/community/security/security-center
packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18325
nvd.nist.gov/vuln/detail/CVE-2018-18325