PT-2007-2114 · Dotnetnuke · Dotnetnuke Iframe Module

Publicado 2007-02-01 · Atualizado 2022-05-01 · CVE-2007-0660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DotNetNuke (DNN) IFrame module versions prior to 03.02.01

Description The issue is related to a cross-site scripting (XSS) vulnerability caused by improper validation of user-supplied input. This allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values." A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. This could be used to steal the victim's cookie-based authentication credentials.

Recommendations For DotNetNuke (DNN) IFrame module versions prior to 03.02.01, update to version 03.02.01 or later to resolve the issue. As a temporary workaround, consider restricting the use of the IFrame module until a patch is applied. Avoid using the module with untrusted input to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-0660

GHSA-XR96-7CCP-PG5C

Produtos afetados

Dotnetnuke Iframe Module

Referências · 9

• https://web.archive.org/web/20081007210427/http://securityfocus.com/bid/22334 · Nota
• http://vupen.com/english/advisories/2007/0433 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32037 · Nota
• https://osv.dev/vulnerability/GHSA-xr96-7ccp-pg5c · Aviso do Fabricante
• http://osvdb.org/36476 · Nota
• http://securityfocus.com/bid/22334 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0660 · Nota de Segurança
• http://dotnetnuke.com/Default.aspx?tabid=825&EntryID=1278 · Nota
• https://web.archive.org/web/20071128032502/http://dotnetnuke.com/Default.aspx?tabid=825&EntryID=1278 · Nota