Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.
Problem types
CWE-20: Improper Input Validation
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Product status
References
github.com/...atform/security/advisories/GHSA-wq2j-w9pm-7x2p
github.com/...ommit/72f30f69fd2214d77f6c2577dfcca495a24caf5c
github.com/.../develop/DNN Platform/Library/UI/Skins/Skin.cs
