CVE-2008-6540: Medium severity DotNetNuke DotNetNuke vulnerability
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/DotNetNuke.Coreto a version that resolves this vulnerability.Fixed in 4.8.2 - Configuration
Edit the application's web.config and replace the default ValidationKey and DecryptionKey entries with unique, non-default keys (do not use the shipped/default keys).
web.config ValidationKey, DecryptionKey = replace default keys with unique non-default values
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6540?
CVE-2008-6540 is considered to have a high severity level due to the potential for unauthorized access by attackers.
How do I fix CVE-2008-6540?
To fix CVE-2008-6540, ensure that the ValidationKey and DecryptionKey in the web.config file are modified from their default values.
Who is affected by CVE-2008-6540?
CVE-2008-6540 affects various versions of DotNetNuke prior to 4.8.2, including early releases such as 1.0.x and 4.5.2.
What type of vulnerability is CVE-2008-6540?
CVE-2008-6540 is a security vulnerability that allows remote attackers to bypass access restrictions due to insecure default keys.
When was CVE-2008-6540 reported?
CVE-2008-6540 was reported in 2008, specifically before the release of DotNetNuke version 4.8.2.