DotNetNuke Prior to 4.8.3 Multiple Remote Vulnerabilites

Bugtraq ID:	29482
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 02 2008 12:00AM
Updated:	Jun 03 2008 11:33PM
Credit:	Tony Valenti, Joseph Ravioli, Tomotoshi Sugishita and Mitchell Sellers and the vendor reported these issues.
Vulnerable:	DotNetNuke DotNetNuke 4.8.2 DotNetNuke DotNetNuke 4.8.1 DotNetNuke DotNetNuke 4.3.5 DotNetNuke DotNetNuke 3.3.5 DotNetNuke DotNetNuke 3.1 .0 DotNetNuke DotNetNuke 3.0.8 DotNetNuke DotNetNuke 3.0.7 DotNetNuke DotNetNuke 4.0
Not Vulnerable:	DotNetNuke DotNetNuke 4.8.3

DotNetNuke Prior to 4.8.3 Multiple Remote Vulnerabilites

DotNetNuke is prone to multiple remote issues:

- A denial-of-service vulnerability
- A security-bypass vulnerability
- An information-disclosure weakness.

An attacker can exploit these issues to cause the application to stop responding, to upload arbitrary 'safe' files to restricted folders, and to obtain sensitive information.

These issues affect DotNetNuke 3.0 to 4.8.2.

DotNetNuke Prior to 4.8.3 Multiple Remote Vulnerabilites

An attacker can use a browser to exploit these issues.

DotNetNuke Prior to 4.8.3 Multiple Remote Vulnerabilites

Solution:
The vendor has released updates. Please see the references for more information.

DotNetNuke Prior to 4.8.3 Multiple Remote Vulnerabilites

References:

• Denial of service attack (DotNetNuke)
  
• DotNetNuke Homepage (DotNetNuke)
  
• Failure to revalidate file and folder permissions correctly for uploads (DotNetNuke)
  
• Force existing database scripts to re-run (DotNetNuke)