CVE-2018-18325

DNN (DotNetNuke) 9.2 through 9.2.2 protects input parameters, including the cookie values used for authentication state, with an encryption algorithm that is too weak; this flaw exists because the earlier fix for CVE-2018-15811 was incomplete. A remote, unauthenticated attacker can abuse the inadequate cryptography to forge or tamper with encrypted parameter values, which the application then deserializes, bypassing the original patch. Successful exploitation exposes sensitive information and, as demonstrated by the public cookie-deserialization exploit, can lead to full remote code execution on the web server. Any organization running DNN 9.2 through 9.2.2, typically as a public-facing .NET CMS website, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2021-11-03 and carries a 74% EPSS probability of exploitation in the next 30 days (99th percentile).

What to do: Upgrade DNN to the updated 9.2.2 release that completes the CVE-2018-15811 fix, or to a later supported version, following vendor update instructions; this is a CISA KEV item, so patching is urgent. Verify the exact version deployed, since sites on the original 9.2.2 build may still lack the complete fix, and until patched, restrict internet exposure of the site and monitor for exploitation of the cookie deserialization path.