DotNetNuke Logging Provider Information Disclosure Vulnerability

Bugtraq ID:	44996
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Aug 17 2010 12:00AM
Updated:	Aug 17 2010 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	DotNetNuke DotNetNuke 5.5.1 DotNetNuke DotNetNuke 5.5 DotNetNuke DotNetNuke 5.4.3 DotNetNuke DotNetNuke 5.4.2 DotNetNuke DotNetNuke 5.4.1 DotNetNuke DotNetNuke 5.4 DotNetNuke DotNetNuke 5.3.1 DotNetNuke DotNetNuke 5.3 DotNetNuke DotNetNuke 5.2.3 DotNetNuke DotNetNuke 5.2 DotNetNuke DotNetNuke 5.1.4 DotNetNuke DotNetNuke 5.1.3 DotNetNuke DotNetNuke 5.1.2 DotNetNuke DotNetNuke 5.1.1 DotNetNuke DotNetNuke 5.1 DotNetNuke DotNetNuke 5.0.1 DotNetNuke DotNetNuke 4.9.5 DotNetNuke DotNetNuke 4.9.4 DotNetNuke DotNetNuke 4.9.3 DotNetNuke DotNetNuke 4.9.1 DotNetNuke DotNetNuke 4.9 DotNetNuke DotNetNuke 4.8.4 DotNetNuke DotNetNuke 4.8.3 DotNetNuke DotNetNuke 4.8.2 DotNetNuke DotNetNuke 4.8.1 DotNetNuke DotNetNuke 4.3.5 DotNetNuke DotNetNuke 3.3.5 DotNetNuke DotNetNuke 3.1 .0 DotNetNuke DotNetNuke 3.0.8 DotNetNuke DotNetNuke 3.0.7 DotNetNuke DotNetNuke 5.0 DotNetNuke DotNetNuke 4.0 DotNetNuke DotNetNuke 3.0
Not Vulnerable:	DotNetNuke DotNetNuke 5.6

DotNetNuke Logging Provider Information Disclosure Vulnerability

DotNetNuke is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

DotNetNuke versions 3.0.0 through 5.5.1 are affected.

DotNetNuke Logging Provider Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

DotNetNuke Logging Provider Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

DotNetNuke Logging Provider Information Disclosure Vulnerability

References:

• DotNetNuke Homepage (DotNetNuke)
  
• Exception details may leak if logging provider unavailable (DotNetNuke)