GHSA-5whq-j5qg-wjvp

ghsaUSosv

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

view advisory published 2019-11-18Licence: CC-BY-4.0

Cross-site scripting (XSS) is possible in DNN (formerly DotNetNuke) before 9.4.0 by remote authenticated users via the Display Name field in the admin notification function.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-12562US	medium6.1	6.15% (93rd)	Exploit	2019-09-26
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit c…

references

External citations — patches, advisories, analysis.

http://packetstormsecurity.com/files/154673/DotNetNuke-Cross-Site-Scripting.htmlWEB
https://mayaseven.com/cve-2019-12562-stored-cross-site-scripting-in-dotnetnuke-dnn-version-v9-3-2WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-12562ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan