What is GHSA-rvrj-j7cc-236p?

GHSA-rvrj-j7cc-236p is a security advisory published by GitHub Security Advisories with Medium severity. DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

Which CVE IDs does GHSA-rvrj-j7cc-236p cover?

GHSA-rvrj-j7cc-236p covers the following CVE IDs: CVE-2013-4649. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-rvrj-j7cc-236p?

GHSA-rvrj-j7cc-236p affects 2 products, including: nuget/DotNetNuke.Core:\u003c 6.2.9; nuget/DotNetNuke.Core:\u003e= 7.0, \u003c 7.1.1.

GHSA-rvrj-j7cc-236pMedium

DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 28, 2023

🔗 CVE IDs covered (1)

CVE-2013-4649 →

📋 Description

Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.

🎯 Affected products2

nuget/DotNetNuke.Core:< 6.2.9
nuget/DotNetNuke.Core:>= 7.0, < 7.1.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2013-4649
https://exchange.xforce.ibmcloud.com/vulnerabilities/86432
http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html
http://secunia.com/advisories/53493
http://www.dnnsoftware.com/platform/manage/security-center
https://github.com/advisories/GHSA-rvrj-j7cc-236p