DotNetNuke Module Administration Security Bypass Vulnerability

Bugtraq ID:	49322
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 24 2011 12:00AM
Updated:	Aug 24 2011 12:00AM
Credit:	Brian Dukes
Vulnerable:	DotNetNuke DotNetNuke 5.6 DotNetNuke DotNetNuke 5.5.1 DotNetNuke DotNetNuke 5.5 DotNetNuke DotNetNuke 5.4.3 DotNetNuke DotNetNuke 5.4.2 DotNetNuke DotNetNuke 5.4.1 DotNetNuke DotNetNuke 5.4 DotNetNuke DotNetNuke 5.3.1 DotNetNuke DotNetNuke 5.3 DotNetNuke DotNetNuke 5.2.3 DotNetNuke DotNetNuke 5.2 DotNetNuke DotNetNuke 5.1.4 DotNetNuke DotNetNuke 5.1.3 DotNetNuke DotNetNuke 5.1.2 DotNetNuke DotNetNuke 5.1.1 DotNetNuke DotNetNuke 5.1 DotNetNuke DotNetNuke 5.0.1 DotNetNuke DotNetNuke 6.0 DotNetNuke DotNetNuke 5.6.3 DotNetNuke DotNetNuke 5.6.1 DotNetNuke DotNetNuke 5.0
Not Vulnerable:	DotNetNuke DotNetNuke 6.0.1

DotNetNuke Module Administration Security Bypass Vulnerability

DotNetNuke is prone to a security-bypass vulnerability.

Successfully exploiting this issue will allow attackers to bypass security restrictions and perform unauthorized actions.

DotNetNuke versions 5.0 through 6.0 are affected.

DotNetNuke Module Administration Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

DotNetNuke Module Administration Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

DotNetNuke Module Administration Security Bypass Vulnerability

References:

• DotNetNuke HomePage (DotNetNuke)
  
• incorrect logic in module administration check (DotNetNuke)