CVE-2008-6540

Severity

51%

Complexity

49%

Confidentiality

106%

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.

CVSS 2.0 Base Score 5.1. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:P).

Overview

Type

DotNetNuke DotNetNuke

First reported 15 years ago

2009-03-30 01:30:00

Last updated 6 years ago

2018-10-11 20:57:00

Affected Software

DotNetNuke DotNetNuke 1.0.6

1.0.6

DotNetNuke DotNetNuke 1.0.7

1.0.7

DotNetNuke DotNetNuke 1.0.8

1.0.8

DotNetNuke DotNetNuke 1.0.9

1.0.9

DotNetNuke DotNetNuke 1.0.10d

1.0.10d

DotNetNuke DotNetNuke 1.0.10e

1.0.10e

DotNetNuke DotNetNuke 2.1.1

2.1.1

DotNetNuke DotNetNuke 2.1.2

2.1.2

DotNetNuke DotNetNuke 3.0.7

3.0.7

DotNetNuke DotNetNuke 3.0.8

3.0.8

DotNetNuke DotNetNuke 3.0.11

3.0.11

DotNetNuke DotNetNuke 3.1.0

3.1.0

DotNetNuke DotNetNuke 3.3.5

3.3.5

DotNetNuke DotNetNuke 4.0

4.0

DotNetNuke DotNetNuke 4.3.5

4.3.5

DotNetNuke DotNetNuke 4.5.2

4.5.2

References

43720

29488

Vendor Advisory

http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx