CVE-2020-37103mediumCWE-79

DotNetNuke 9.5 - Persistent Cross-Site Scripting

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.3%

probabilidade de exploração

0.3%top 79% das CVEs

exploração observada

nãonenhuma fonte reporta

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Produtos afetados

Dnnsoftware · DotNetNuke

Referências

http://dnnsoftware.com/https://medium.com/@SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175 https://www.exploit-db.com/exploits/48124 https://www.vulncheck.com/advisories/dotnetnuke-persistent-cross-site-scripting