CVE-2020-37103DotNetNuke 9.5 - Persistent Cross-Site Scripting

Beschreibung

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• ExploitDB-48124 exploitExploitThird Party AdvisoryVDB Entry
• DotNetNuke Official Vendor Homepage productProduct
• Vulnerability Analysis Blog Post technical-descriptionThird Party Advisory
• VulnCheck Advisory: DotNetNuke 9.5 - Persistent Cross-Site Scripting third-party-advisoryThird Party Advisory