CVE-2008-6540 DotNetNuke Default Machine Key Exposure
MediumCVSS 5.1
EPSS 2.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget DotNetNuke.Core(NuGet) | < 4.8.2 | 4.8.2 |
| dnnsoftware dotnetnuke | <= 4.8.1 | No fix listed |
| dnnsoftware dotnetnuke | = 1.0.6 | No fix listed |
| dnnsoftware dotnetnuke | = 1.0.7 | No fix listed |
| dnnsoftware dotnetnuke | = 1.0.8 | No fix listed |
| dnnsoftware dotnetnuke | = 1.0.9 | No fix listed |
| dnnsoftware dotnetnuke | = 1.0.10d | No fix listed |
| dnnsoftware dotnetnuke | = 1.0.10e | No fix listed |
| dnnsoftware dotnetnuke | = 2.1.1 | No fix listed |
| dnnsoftware dotnetnuke | = 2.1.2 | No fix listed |
| dnnsoftware dotnetnuke | = 3.0.7 | No fix listed |
| dnnsoftware dotnetnuke | = 3.0.8 | No fix listed |
| dnnsoftware dotnetnuke | = 3.0.11 | No fix listed |
| dnnsoftware dotnetnuke | = 3.1.0 | No fix listed |
| dnnsoftware dotnetnuke | = 3.3.5 | No fix listed |
| dnnsoftware dotnetnuke | = 4.0 | No fix listed |
| dnnsoftware dotnetnuke | = 4.3.5 | No fix listed |
| dnnsoftware dotnetnuke | = 4.5.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- dotnetnuke-webconfig-weak-security(41399) vdb-entry
- 43720 vdb-entry
- 29488 third-party-advisory vendor-advisory
- www.dotnetnuke.com vendor-advisory
- 20080321 DotNetNuke Default Machine Key Exposure mailing-list
- 28391 exploit vdb-entry
- github.com
- github.com product