Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
DotNetNuke 默认'ValidationKey'和 'DecriptionKey' 弱加密漏洞
Vulnerability Description
DotNetNuke是一款基于Microsoft .NE的内容管理系统和应用开发平台。 DotNetNuke 4.8.2版本之前的版本,在安装或更新的过程中，没有在默认的(1)ValidationKey和(2)web.config文件中的DecryptionKey的值不能被修改时警告管理员，这会允许远程攻击者通过运行默认密码本绕过预设的访问限制。
CVSS Information
N/A
Vulnerability Type
N/A