CVE-2018-15812
Insufficient Entropy in DotNetNuke
CVE-2018-15812 is a high vulnerability (CVSS 7.5) in Dnnsoftware Dotnetnuke, published July 3, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.2%, the 98th percentile. Fixed in DotNetNuke.Core 9.2.2.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 47.2%EPSS, 98th percentile
- Exploitation
- None known2 public exploits
- Fixed in
9.2.2DotNetNuke.Core +1 more
Description
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet | 9.2.0 up to 9.2.2 | 9.2.2 |
DotNetNuke.CoreNuGet | 9.2.0 up to 9.2.2, plus listed versions 9.2.0.3669.2.1.533 | 9.2.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | DotNetNuke Cookie Deserialization Remote Code Excecution | 2017-07-20 |
| Exploit-DB | DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit) | 2020-04-16 |
What each source reports
NVD Score used
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Record
CVE-2018-15812- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
CVE ListNo score
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Record
CVE-2018-15812- Updated
- 2026-11-02
EUVDEUVD-2019-0600No score
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Record
EUVD-2019-0600- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pf46-gqg9-j3v3
Insufficient Entropy in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Record
GHSA-pf46-gqg9-j3v3- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
OSV
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Record
CVE-2018-15812- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-pf46-gqg9-j3v3
Insufficient Entropy in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Record
GHSA-pf46-gqg9-j3v3- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.