CVEvulnerability
CVE-2008-6540
5.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-03-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Affected configurations
• dnnsoftware dotnetnuke (<= 4.8.1)
• dnnsoftware dotnetnuke 1.0.6
• dnnsoftware dotnetnuke 1.0.7
• dnnsoftware dotnetnuke 1.0.8
• dnnsoftware dotnetnuke 1.0.9
• dnnsoftware dotnetnuke 1.0.10d
• dnnsoftware dotnetnuke 1.0.10e
• dnnsoftware dotnetnuke 2.1.1
• dnnsoftware dotnetnuke 2.1.2
• dnnsoftware dotnetnuke 3.0.7
• dnnsoftware dotnetnuke 3.0.8
• dnnsoftware dotnetnuke 3.0.11
• dnnsoftware dotnetnuke 3.1.0
• dnnsoftware dotnetnuke 3.3.5
• dnnsoftware dotnetnuke 4.0
• dnnsoftware dotnetnuke 4.3.5
• dnnsoftware dotnetnuke 4.5.2
Related
Weakness · not in database (1)
References
- http://osvdb.org/43720 osvdb.org
- http://secunia.com/advisories/29488 Vendor Advisory
- http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx Vendor Advisory
- http://www.securityfocus.com/archive/1/489957/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28391 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41399 exchange.xforce.ibmcloud.com
- http://osvdb.org/43720 osvdb.org
- http://secunia.com/advisories/29488 Vendor Advisory
- http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx Vendor Advisory
- http://www.securityfocus.com/archive/1/489957/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28391 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41399 exchange.xforce.ibmcloud.com