HIGH7.6
GHSA-2g5g-hcgh-q3rp
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
Quick fix
GHSA-2g5g-hcgh-q3rp — DotNetNuke.Core: upgrade to the fixed version with the command below.
dotnet add package DotNetNuke.Core --version 10.02.0Details
Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/DotNetNuke.Core
Introduced in:
9.0.0No fixed version published yet for DotNetNuke.Core (nuget). Pin to a known-safe version or switch to an alternative.
NuGet/DotNetNuke.Core
Introduced in:
10.0.0Fixed in: 10.02.0Fix
dotnet add package DotNetNuke.Core --version 10.02.0