CVE-2018-18325VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

Affects DotNetNuke (DNN) DotNetNuke (DNN)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 74.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2018-18325 (opens in a new tab)

Description

DotNetNuke (DNN) suffers from an inadequate encryption strength vulnerability due to the use of a weak encryption algorithm to protect input parameters. This issue is a follow-up to an incomplete patch for a previous vulnerability (CVE-2018-15811). The vulnerability has been exploited in the wild, indicating active threat usage.

Summary

CVE-2018-18325 identifies a weakness in DotNetNuke (DNN) where input parameters are protected using insufficient encryption strength. This vulnerability stems from the use of a weak encryption algorithm, which compromises the security of the protected data. It addresses an incomplete fix for an earlier vulnerability (CVE-2018-15811), suggesting that the initial remediation was insufficient. The vulnerability has been observed to be exploited in the wild, highlighting its practical impact.

Impact

The use of weak encryption algorithms to protect input parameters can allow attackers to bypass security controls, potentially leading to unauthorized access or data exposure. Given that exploitation in the wild has been reported, this vulnerability poses a significant risk to affected DotNetNuke installations. The exact impact depends on the context in which the encryption is used but generally undermines the confidentiality and integrity of protected data.

Mitigation

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider additional protective measures such as restricting access to vulnerable components or employing compensating controls to mitigate risk.

Weaknesses

CWE-326Inadequate Encryption Strength (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:27:03 UTC

Weaknesses

References

Related threats