lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 16 May 2005 15:37:43 +0100
From: "Mark Woan" <>
To: <>
Subject: DotNetNuke (Multiple XSS)

                           Security Advisory

    Advisory Name: Multiple DotNetNuke Cross Site Scripting (XSS)
     Release Date: 16/05/2005
      Application: DotNetNuke (Multiple versions affected)
         Platform: Microsoft Windows
Versions Affected: Versions below 3.0.12
         Severity: Allows unauthenticated cross site scripting attacks
           Author: Mark Woan (m.woan[at]
    Vendor Status: Informed and patch available
    CVE Candidate: CAN-2005-0040


DotNetNuke is an Open Source hybrid of the IBuySpy Portal. Its management
team is dedicated to the ongoing management of core portal application
DotNetNuke provides automated content management capabilities and tools to
maintain a dynamic and 100% interactive data-driven web site.


Issue 1 (XSS)
There is a vulnerability caused by the lack of input validation when
registering a new user within a DotNetNuke portal. An attacker could use a
cross site scripting
(XSS) attack when registering a new user, when the View All User Details
page the malicious code will be executed, resulting in the capture of
Administrative session credentials. Versions prior to 3.0.12 appear to be

Issue 2 (Secondary XSS)
The User-Agent string sent with each request is stored for logging purposes.
This data comes from the client and cannot be trusted, and therefore must be
An attacker could set the User-Agent string for the request to malicious
script code, which would be logged and executed when any logs are viewed
that contain the User-Agent field. This attack can be utilised by an
unauthenticated user simply requesting the root page. 

Issue 3 (Secondary XSS)
The failed logon Username is stored and displayed on the Log Viewer page. An
attacker can send a Logon request with malicious script set as the parameter
value, the script passed in the parameter will be executed when an
Administrative user views the Log Viewer page or any log page that displays
the failed logon Username.

Vendor Response:

05-01-2005 Contacted core development team via email
10-01-2005 Response from vendor received and confirmed
10-01-2005 Second mail sent regarding more issues
13-01-2005 Sent email asking for confirmation of second email (No vendor
12-03-2005 DotNetNuke v3.0.12 released (All reported security issues fixed)


Users should install DotNetNuke v3.0.12 or greater.

Thanks to NISCC ( for their help assigning the CVE

Powered by blists - more mailing lists