Description: Some vulnerabilities have been reported in DotNetNuke, which can be exploited by malicious people to conduct cross-site scripting attacks.
1) Input passed via invalid URLs is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) The Language skin object does not properly sanitise certain input before returning it to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Successful exploitation requires that multiple language packs are installed and the Language skin object is used.
NOTE: A cross-site scripting vulnerability when an error occurs while installing DotNetNuke has also been reported.
The vulnerabilities are reported in versions prior to 4.8.4.
Solution: Update to version 4.8.4.
Provided and/or discovered by: The vendor credits:
1) AmnPardaz Security Research & Penetration Testing Group
2) Mauricio Marquez
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
