PT-2004-3218 · Dnn · Dotnetnuke

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2324

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: DotNetNuke versions 1.0.6 through 1.0.10d

Description: The issue allows remote attackers to modify the backend database. This is achieved via the table and field parameters in the "LinkClick.aspx" endpoint.

Recommendations: For versions 1.0.6 through 1.0.10d, consider restricting access to the "LinkClick.aspx" endpoint to minimize the risk of exploitation. Avoid using the table and field parameters in this endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2004-2324

Affected Products

Dotnetnuke

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-2324 · Security Note
• http://securityfocus.com/bid/9518 · Patch
• http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html · Vendor Advisory
• http://osvdb.org/3750 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2324 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14973 · Note
• http://secunia.com/advisories/10747 · Note