DotNetNuke Multiple Security Vulnerabilities
BID:40947
Info
DotNetNuke Multiple Security Vulnerabilities
| Bugtraq ID: | 40947 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 14 2010 12:00AM |
| Updated: | Jun 14 2010 12:00AM |
| Credit: | Roger Selwyn, PowerDNN Engineering Team, Chris Wood, Eugene Wahrlich of MWR InfoSecurity. |
| Vulnerable: |
DotNetNuke DotNetNuke 5.4.2 DotNetNuke DotNetNuke 5.4.1 DotNetNuke DotNetNuke 5.4 DotNetNuke DotNetNuke 5.3.1 DotNetNuke DotNetNuke 5.3 DotNetNuke DotNetNuke 5.2.3 DotNetNuke DotNetNuke 5.2 DotNetNuke DotNetNuke 5.1.4 DotNetNuke DotNetNuke 5.1.3 DotNetNuke DotNetNuke 5.1.2 DotNetNuke DotNetNuke 5.1.1 DotNetNuke DotNetNuke 5.1 DotNetNuke DotNetNuke 5.0.1 DotNetNuke DotNetNuke 4.9.5 DotNetNuke DotNetNuke 4.9.4 DotNetNuke DotNetNuke 4.9.3 DotNetNuke DotNetNuke 4.9.1 DotNetNuke DotNetNuke 4.9 DotNetNuke DotNetNuke 4.8.4 DotNetNuke DotNetNuke 4.8.3 DotNetNuke DotNetNuke 4.8.2 DotNetNuke DotNetNuke 4.8.1 DotNetNuke DotNetNuke 4.3.5 DotNetNuke DotNetNuke 3.3.5 DotNetNuke DotNetNuke 3.1 .0 DotNetNuke DotNetNuke 3.0.8 DotNetNuke DotNetNuke 3.0.7 DotNetNuke DotNetNuke 2.1.2 DotNetNuke DotNetNuke 2.1.1 DotNetNuke DotNetNuke 1.0.10 e DotNetNuke DotNetNuke 1.0.10 d DotNetNuke DotNetNuke 1.0.9 DotNetNuke DotNetNuke 1.0.8 DotNetNuke DotNetNuke 1.0.7 DotNetNuke DotNetNuke 1.0.6 DotNetNuke DotNetNuke 5.0 DotNetNuke DotNetNuke 4.0 DotNetNuke DotNetNuke 3.0 |
| Not Vulnerable: |
DotNetNuke DotNetNuke 5.4.3 |
Discussion
DotNetNuke Multiple Security Vulnerabilities
DotNetNuke is prone to multiple security vulnerabilities. These vulnerabilities include a cross-site scripting vulnerability, multiple information-disclosure vulnerabilities, and a cross-site request-forgery vulnerability.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions. Other attacks are also possible.
Versions prior to DotNetNuke 5.4.3 are vulnerable.
DotNetNuke is prone to multiple security vulnerabilities. These vulnerabilities include a cross-site scripting vulnerability, multiple information-disclosure vulnerabilities, and a cross-site request-forgery vulnerability.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions. Other attacks are also possible.
Versions prior to DotNetNuke 5.4.3 are vulnerable.
Solution / Fix
DotNetNuke Multiple Security Vulnerabilities
Solution:
An update is available. Please see the references for more details.
Solution:
An update is available. Please see the references for more details.
References
DotNetNuke Multiple Security Vulnerabilities
References:
References:
- DotNetNuke Homepage (DotNetNuke)
- Logfiles contents after exception may lead to information leakage (DotNetNuke)
- Mail function can result in unauthorized email access (DotNetNuke)
- update inputfilter blacklist for invalid tag that could allow XSS attack (DotNetNuke)
- Cross-site request forgery possible against other users of a site (DotNetNuke)
- DotNetNuke 5.4.3 Released (DotNetNuke)
- Member only profile properties could be exposed under certain conditions (DotNetNuke)