发布时间 :2004-12-31 00:00:00
修订时间 :2017-07-10 21:31:47

[原文]Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject arbitrary web script or HTML.


        DotNetNuke (formerly IBuySpy Workshop) 1.0.6到1.0.10d版本的EditModule.aspx存在跨站脚本攻击(XSS)漏洞。远程攻击者可以注入任意web脚本或HTML。

- CVSS (基础分值)

CVSS分值: 4.3 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:dotnetnuke:dotnetnuke:1.0.6DotNetNuke DotNetNuke 1.0.6
cpe:/a:dotnetnuke:dotnetnuke:1.0.8DotNetNuke DotNetNuke 1.0.8
cpe:/a:dotnetnuke:dotnetnuke:1.0.7DotNetNuke DotNetNuke 1.0.7
cpe:/a:dotnetnuke:dotnetnuke:1.0.9DotNetNuke DotNetNuke 1.0.9
cpe:/a:dotnetnuke:dotnetnuke:1.0.10dDotNetNuke DotNetNuke 1.0.10d

- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(VENDOR_ADVISORY)  FULLDISC  20040128 Dotnetnuke Multiple Vulnerabilities
(PATCH)  BID  9518
(UNKNOWN)  XF  dotnetnuke-editmoduleaspxxss(14974)

- 漏洞信息

中危 跨站脚本
2004-12-31 00:00:00 2005-10-20 00:00:00
        DotNetNuke (formerly IBuySpy Workshop) 1.0.6到1.0.10d版本的EditModule.aspx存在跨站脚本攻击(XSS)漏洞。远程攻击者可以注入任意web脚本或HTML。

- 公告与补丁

        The vendor has released fixes to address this issue. Users are advised to download either DotNetNuke 1.0.10e - FULL (for those who are installing DotNetNuke for the first time or are running a version prior to 1.0.10d) or DotNetNuke 1.0.10e - PATCH (or those who are already running DotNetNuke 1.0.10d) from the vendor site.

- 漏洞信息

DotNetNuke editModule.aspx XSS
Remote / Network Access Input Manipulation
Loss of Integrity

- 漏洞描述

DotNetNuke contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input variables upon submission to the EditModule.aspx script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

- 时间线

2004-01-28 Unknow
Unknow Unknow

- 解决方案

Upgrade to version10.0.10e or higher, as it has been reported to fix this vulnerability. An upgrade is recommended as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete