PT-2007-2114 · Dotnetnuke · Dotnetnuke Iframe Module

Published 2007-02-01 · Updated 2022-05-01 · CVE-2007-0660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DotNetNuke (DNN) IFrame module versions prior to 03.02.01

Description The issue is related to a cross-site scripting (XSS) vulnerability caused by improper validation of user-supplied input. This allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values." A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. This could be used to steal the victim's cookie-based authentication credentials.

Recommendations For DotNetNuke (DNN) IFrame module versions prior to 03.02.01, update to version 03.02.01 or later to resolve the issue. As a temporary workaround, consider restricting the use of the IFrame module until a patch is applied. Avoid using the module with untrusted input to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-0660

GHSA-XR96-7CCP-PG5C

Affected Products

Dotnetnuke Iframe Module

References · 9

• https://osv.dev/vulnerability/GHSA-xr96-7ccp-pg5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0660 · Security Note
• https://web.archive.org/web/20081007210427/http://securityfocus.com/bid/22334 · Note
• http://vupen.com/english/advisories/2007/0433 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32037 · Note
• http://osvdb.org/36476 · Note
• http://securityfocus.com/bid/22334 · Note
• http://dotnetnuke.com/Default.aspx?tabid=825&EntryID=1278 · Note
• https://web.archive.org/web/20071128032502/http://dotnetnuke.com/Default.aspx?tabid=825&EntryID=1278 · Note