CVE-2020-37103mediumCWE-79

DotNetNuke 9.5 - Persistent Cross-Site Scripting

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%

probabilidad de explotación

0.3%top 79% de las CVE

explotación observada

noninguna fuente lo reporta

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Productos afectados

Dnnsoftware · DotNetNuke

Referencias

http://dnnsoftware.com/https://medium.com/@SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175 https://www.exploit-db.com/exploits/48124 https://www.vulncheck.com/advisories/dotnetnuke-persistent-cross-site-scripting