DNN (DotNetNuke) < 8.0.4 Multiple Vulnerabilities

medium Nessus Plugin ID 93197

Language:

Synopsis

The remote web server contains an ASP.NET application that is affected by multiple vulnerabilities.

Description

The version of DNN Platform (formerly DotNetNuke) running on the remote host is affected by multiple vulnerabilities :

- A flaw exists due to improper validation of user permissions. An authenticated, remote attacker with permissions to edit a particular page can exploit this to make changes to site containers across all pages.

- A cross-site redirection vulnerability exists due to improper validation of links to the registration page before returning it to the user. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a crafted link, to redirect the user to a malicious website

- An unspecified flaw exists that allows an authenticated, remote attacker with access to files outside of the root of the DNN site, to copy an existing image to any location on the server.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to DNN Platform version 8.0.4 or later.

Plugin Details

Severity: Medium

ID: 93197

File Name: dotnetnuke_8_0_4.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 8/29/2016

Updated: 6/5/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Vulnerability Information

CPE: cpe:/a:dotnetnuke:dotnetnuke

Required KB Items: installed_sw/DNN

Excluded KB Items: Settings/disable_cgi_scanning

Patch Publication Date: 8/20/2016

Vulnerability Publication Date: 8/20/2016

Detections

Analytics