PT-2004-3218 · Dnn · Dotnetnuke

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2324

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: DotNetNuke versions 1.0.6 through 1.0.10d

Description: The issue allows remote attackers to modify the backend database. This is achieved via the table and field parameters in the "LinkClick.aspx" endpoint.

Recommendations: For versions 1.0.6 through 1.0.10d, consider restricting access to the "LinkClick.aspx" endpoint to minimize the risk of exploitation. Avoid using the table and field parameters in this endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-2324

Produtos afetados

Dotnetnuke

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-2324 · Nota de Segurança
• http://osvdb.org/3750 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2324 · Nota
• http://securityfocus.com/bid/9518 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14973 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html · Aviso do Fabricante
• http://secunia.com/advisories/10747 · Nota