PT-2009-6288 · Dnn · Dotnetnuke

Published 2009-11-28 · Updated 2009-11-30 · CVE-2009-4109

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DotNetNuke versions 4.0 through 5.1.4

Description The issue allows remote attackers to access version information and possibly other sensitive information due to the install wizard not preventing anonymous users from accessing certain functionality.

Recommendations For versions 4.0 through 5.1.4, consider restricting access to the install wizard to prevent anonymous users from accessing sensitive information until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-4109

Affected Products

Dotnetnuke

References · 6

• http://secunia.com/advisories/37480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4109 · Security Note
• http://dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4109 · Note
• http://osvdb.org/60520 · Note
• http://securityfocus.com/bid/37139 · Note