Lucene search
GoogleOSV:GHSA-GRW3-HJJM-5CJMHistoryMay 14, 2022 - 2:38 a.m.
DotNetNuke Default Machine Key Exposure
2022-05-1402:38:47
Google
osv.dev
6
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
References
osvdb.org/43720
secunia.com/advisories/29488
www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx
www.securityfocus.com/archive/1/489957/100/0/threaded
www.securityfocus.com/bid/28391
exchange.xforce.ibmcloud.com/vulnerabilities/41399
github.com/dnnsoftware/Dnn.Platform
nvd.nist.gov/vuln/detail/CVE-2008-6540
Related
prion
prion
Design/Logic Flaw
2009-03-30 01:30:00
nessus
nessus
cvelist
cvelist
CVE-2008-6540
2009-03-30 01:00:00
github
github
DotNetNuke Default Machine Key Exposure
2022-05-14 02:38:47
cve
cve
CVE-2008-6540
2009-03-30 01:30:00
nvd
nvd
CVE-2008-6540
2009-03-30 01:30:00