GitHub Advisoryadvisory · NuGet

GHSA-rvrj-j7cc-236p DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

MEDIUM Published 2022-05-17 Modified 2023-08-28 Official page ↗
Aliases
CVE-2013-4649
Ecosystem
NuGet
Packages
DotNetNuke.Core
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-08-28

Affected packages

• NuGet DotNetNuke.Core: < 6.2.9 → fixed in 6.2.9 • NuGet DotNetNuke.Core: >= 7.0, < 7.1.1 → fixed in 7.1.1

Description

Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.

Related

Alias · CVE (1)

  • CVE-2013-4649 Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References