DotNetNuke Cross Site Scripting and Information Disclosure Vulnerabilities
BID:37139
Info
DotNetNuke Cross Site Scripting and Information Disclosure Vulnerabilities
| Bugtraq ID: | 37139 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2009 12:00AM |
| Updated: | Nov 30 2009 03:45PM |
| Credit: | Scott Bell and Dan Gilleland. |
| Vulnerable: |
DotNetNuke DotNetNuke 5.1.4 DotNetNuke DotNetNuke 5.1.3 DotNetNuke DotNetNuke 5.1.2 DotNetNuke DotNetNuke 5.1.1 DotNetNuke DotNetNuke 5.1 DotNetNuke DotNetNuke 5.0.1 DotNetNuke DotNetNuke 4.9.5 DotNetNuke DotNetNuke 4.9.4 DotNetNuke DotNetNuke 4.9.3 DotNetNuke DotNetNuke 4.9.1 DotNetNuke DotNetNuke 4.9 DotNetNuke DotNetNuke 4.8.4 DotNetNuke DotNetNuke 4.8.3 DotNetNuke DotNetNuke 4.8.2 DotNetNuke DotNetNuke 4.8.1 DotNetNuke DotNetNuke 4.3.5 DotNetNuke DotNetNuke 5.0 DotNetNuke DotNetNuke 4.0 |
| Not Vulnerable: |
DotNetNuke DotNetNuke 5.2 |
Discussion
DotNetNuke Cross Site Scripting and Information Disclosure Vulnerabilities
DotNetNuke is prone to cross-site scripting and information-disclosure vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also obtain sensitive information.
DotNetNuke is prone to cross-site scripting and information-disclosure vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also obtain sensitive information.
Exploit / POC
DotNetNuke Cross Site Scripting and Information Disclosure Vulnerabilities
Attackers may exploit these issues via a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Attackers may exploit these issues via a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
DotNetNuke Cross Site Scripting and Information Disclosure Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
DotNetNuke Cross Site Scripting and Information Disclosure Vulnerabilities
References:
References:
- DotNetNuke Homepage (DotNetNuke)
- HTML/Script Code Injection Vulnerability (DotNetNuke)
- Install Wizard information leakage (DotNetNuke)