GitHub Advisoryadvisory · NuGet

GHSA-grw3-hjjm-5cjm DotNetNuke Default Machine Key Exposure

MEDIUM Published 2022-05-14 Modified 2023-09-22 Official page ↗
Aliases
CVE-2008-6540
Ecosystem
NuGet
Packages
DotNetNuke.Core
Severity
Moderate
Weaknesses
CWE-453
Reviewed
2023-09-22

Affected packages

• NuGet DotNetNuke.Core: < 4.8.2 → fixed in 4.8.2

Description

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.

Related

Alias · CVE (1)

  • CVE-2008-6540 DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2)… vulnerability

Weakness · CWE (1)

  • CWE-453 Insecure Default Variable Initialization weakness

References