MEDIUM6.1

GHSA-5whq-j5qg-wjvp

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

Quick fix

GHSA-5whq-j5qg-wjvp — DotNetNuke.Core: upgrade to the fixed version with the command below.

dotnet add package DotNetNuke.Core --version 9.4.0

Details

Cross-site scripting (XSS) is possible in DNN (formerly DotNetNuke) before 9.4.0 by remote authenticated users via the Display Name field in the admin notification function.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/DotNetNuke.Core

Introduced in: 0Fixed in: 9.4.0

Fixdotnet add package DotNetNuke.Core --version 9.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2019-12562[ADVISORY]
https://mayaseven.com/cve-2019-12562-stored-cross-site-scripting-in-dotnetnuke-dnn-version-v9-3-2[WEB]
http://packetstormsecurity.com/files/154673/DotNetNuke-Cross-Site-Scripting.html[WEB]