DotNetNuke Cross Site Scripting and Security Bypass Vulnerabilities

Bugtraq ID:	54444
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jul 13 2012 12:00AM
Updated:	Jul 13 2012 12:00AM
Credit:	credits Lei, Chris Hammond, Sunil Yadav via Secunia, Simon Meraner
Vulnerable:	DotNetNuke DotNetNuke 6.0.2 DotNetNuke DotNetNuke 6.0.1 DotNetNuke DotNetNuke 5.6 DotNetNuke DotNetNuke 5.5.1 DotNetNuke DotNetNuke 5.5 DotNetNuke DotNetNuke 6.1.4 DotNetNuke DotNetNuke 6.1.3 DotNetNuke DotNetNuke 6.1.2 DotNetNuke DotNetNuke 6.1.0 DotNetNuke DotNetNuke 6.0 DotNetNuke DotNetNuke 5.6.7 DotNetNuke DotNetNuke 5.6.4 DotNetNuke DotNetNuke 5.6.3 DotNetNuke DotNetNuke 5.6.1
Not Vulnerable:	DotNetNuke DotNetNuke 5.6.8

DotNetNuke Cross Site Scripting and Security Bypass Vulnerabilities

DotNetNuke is prone to the following vulnerabilities:

1. A security-bypass vulnerability

2. Multiple cross-site scripting vulnerabilities

Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, to execute arbitrary script code in the browser of an unsuspecting user, to steal cookie-based authentication credentials, and to perform certain administrative actions in the vulnerable application.

DotNetNuke Cross Site Scripting and Security Bypass Vulnerabilities

Attackers can use a browser to exploit these issues.

DotNetNuke Cross Site Scripting and Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

DotNetNuke Cross Site Scripting and Security Bypass Vulnerabilities

References:

• DotNetNuke HomePage (DotNetNuke)