{"id": "CVE-2008-7102", "bulletinFamily": "NVD", "title": "CVE-2008-7102", "description": "DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx files instead of skin files, and possibly access privileged functionality, via unknown vectors related to parameter validation.", "published": "2009-08-27T16:30:00", "modified": "2017-08-16T21:29:49", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7102", "reporter": "NVD", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/45077", "http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno23/tabid/1176/Default.aspx", "http://www.securityfocus.com/bid/31145"], "cvelist": ["CVE-2008-7102"], "type": "cve", "lastseen": "2017-08-17T11:14:09", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:dotnetnuke:dotnetnuke:4.8.1", "cpe:/a:dotnetnuke:dotnetnuke:4.5.5", "cpe:/a:dotnetnuke:dotnetnuke:3.0.8", "cpe:/a:dotnetnuke:dotnetnuke:4.5.4", "cpe:/a:dotnetnuke:dotnetnuke:3.1.0", "cpe:/a:dotnetnuke:dotnetnuke:4.7.0", "cpe:/a:dotnetnuke:dotnetnuke:4.8.0", "cpe:/a:dotnetnuke:dotnetnuke:4.0", "cpe:/a:dotnetnuke:dotnetnuke:3.0.11", "cpe:/a:dotnetnuke:dotnetnuke:4.6.0", "cpe:/a:dotnetnuke:dotnetnuke:3.3.5", "cpe:/a:dotnetnuke:dotnetnuke:4.4.1", "cpe:/a:dotnetnuke:dotnetnuke:4.3.5", "cpe:/a:dotnetnuke:dotnetnuke:4.6.2", "cpe:/a:dotnetnuke:dotnetnuke:4.8.4", "cpe:/a:dotnetnuke:dotnetnuke:4.8.3", "cpe:/a:dotnetnuke:dotnetnuke:2.1.1", "cpe:/a:dotnetnuke:dotnetnuke:4.8.2", "cpe:/a:dotnetnuke:dotnetnuke:4.6.1", "cpe:/a:dotnetnuke:dotnetnuke:3.0.7", "cpe:/a:dotnetnuke:dotnetnuke:2.1.2", "cpe:/a:dotnetnuke:dotnetnuke:4.5.2"], "cvelist": ["CVE-2008-7102"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx files instead of skin files, and possibly access privileged functionality, via unknown vectors related to parameter validation.", "edition": 1, "enchantments": {}, "hash": "b17ddc85548361d430fdd8ae7e3d1db0f94acd3d26de1648116d8c8e743f80c6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "d12058ec6394f94283a168d61ca67e8e", "key": "description"}, {"hash": "13d8ff43070576ee1c516181e501a867", "key": "references"}, {"hash": "8c7c820545706d011c41991d76f7d2be", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "520a3ddd9cabb58d37b41787ca386adf", "key": "href"}, {"hash": "c5de515f7fa0016934b65472f5402caa", "key": "modified"}, {"hash": "77ae911521c77630a3da31ed2ff63e8e", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "796376b1fd66a92be1275163150bd7cc", "key": "published"}, {"hash": "1009b72a90f89f3ce84c6217be84bd0b", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7102", "id": "CVE-2008-7102", "lastseen": "2016-09-03T11:52:55", "modified": "2009-08-28T00:00:00", "objectVersion": "1.2", "published": "2009-08-27T16:30:00", "references": ["http://xforce.iss.net/xforce/xfdb/45077", "http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno23/tabid/1176/Default.aspx", "http://www.securityfocus.com/bid/31145"], "reporter": "NVD", "scanner": [], "title": "CVE-2008-7102", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T11:52:55"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "1009b72a90f89f3ce84c6217be84bd0b"}, {"key": "cvelist", "hash": "8c7c820545706d011c41991d76f7d2be"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "d12058ec6394f94283a168d61ca67e8e"}, {"key": "href", "hash": "520a3ddd9cabb58d37b41787ca386adf"}, {"key": "modified", "hash": "a7df42a62dc4bd40444b6eb188757036"}, {"key": "published", "hash": "796376b1fd66a92be1275163150bd7cc"}, {"key": "references", "hash": "20f260a26f329feafb9fa597dbd66ae9"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "77ae911521c77630a3da31ed2ff63e8e"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "9ce4d0dca11a32342956cb044004949db067d6b5d8656433235a4c7bc9addef1", "viewCount": 0, "enchantments": {"score": {"value": 5.0, "vector": "NONE", "modified": "2017-08-17T11:14:09"}, "vulnersScore": 5.0}, "objectVersion": "1.3", "cpe": ["cpe:/a:dotnetnuke:dotnetnuke:4.8.1", "cpe:/a:dotnetnuke:dotnetnuke:4.5.5", "cpe:/a:dotnetnuke:dotnetnuke:3.0.8", "cpe:/a:dotnetnuke:dotnetnuke:4.5.4", "cpe:/a:dotnetnuke:dotnetnuke:3.1.0", "cpe:/a:dotnetnuke:dotnetnuke:4.7.0", "cpe:/a:dotnetnuke:dotnetnuke:4.8.0", "cpe:/a:dotnetnuke:dotnetnuke:4.0", "cpe:/a:dotnetnuke:dotnetnuke:3.0.11", "cpe:/a:dotnetnuke:dotnetnuke:4.6.0", "cpe:/a:dotnetnuke:dotnetnuke:3.3.5", "cpe:/a:dotnetnuke:dotnetnuke:4.4.1", "cpe:/a:dotnetnuke:dotnetnuke:4.3.5", "cpe:/a:dotnetnuke:dotnetnuke:4.6.2", "cpe:/a:dotnetnuke:dotnetnuke:4.8.4", "cpe:/a:dotnetnuke:dotnetnuke:4.8.3", "cpe:/a:dotnetnuke:dotnetnuke:2.1.1", "cpe:/a:dotnetnuke:dotnetnuke:4.8.2", "cpe:/a:dotnetnuke:dotnetnuke:4.6.1", "cpe:/a:dotnetnuke:dotnetnuke:3.0.7", "cpe:/a:dotnetnuke:dotnetnuke:2.1.2", "cpe:/a:dotnetnuke:dotnetnuke:4.5.2"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"openvas": [{"lastseen": "2018-09-02T00:06:04", "references": ["http://xforce.iss.net/xforce/xfdb/45077", "http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno23/tabid/1176/Default.aspx"], "pluginID": "1361412562310800685", "description": "The host is installed with DotNetNuke and is prone to security\n bypass vulnerability.", "edition": 3, "reporter": "Copyright (C) 2009 Greenbone Networks GmbH", "published": "2009-09-03T00:00:00", "title": "DotNetNuke Skin Files Security Bypass Vulnerability", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Web application abuses", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-7102"], "modified": "2016-12-28T00:00:00", "id": "OPENVAS:1361412562310800685", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310800685", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_dotnetnuke_skin_sec_bypass_vuln.nasl 4865 2016-12-28 16:16:43Z teissa $\n#\n# DotNetNuke Skin Files Security Bypass Vulnerability\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#######################################`########################################\n\nCPE = \"cpe:/a:dotnetnuke:dotnetnuke\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.800685\");\n script_version(\"$Revision: 4865 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-12-28 17:16:43 +0100 (Wed, 28 Dec 2016) $\");\n script_tag(name:\"creation_date\", value:\"2009-09-03 16:18:01 +0200 (Thu, 03 Sep 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2008-7102\");\n script_bugtraq_id(31145);\n script_name(\"DotNetNuke Skin Files Security Bypass Vulnerability\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_dotnetnuke_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"dotnetnuke/installed\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allows remote attackers to gain administrative\n privileges or compromise the affected system.\n\n Impact Level: Application\");\n script_tag(name:\"affected\", value:\"DotNetNuke versions 2.0 to 4.8.4.\");\n script_tag(name:\"insight\", value:\"The vulnerability is caused due improper validation of user data passed\n via unspecified parameters before being used to load skin files.\");\n script_tag(name:\"solution\", value:\"Upgrade to DotNetNuke version 4.9.0 or latest\n For updates refer to http://www.dotnetnuke.com/\");\n script_tag(name:\"summary\", value:\"The host is installed with DotNetNuke and is prone to security\n bypass vulnerability.\");\n\n script_xref(name:\"URL\", value:\"http://xforce.iss.net/xforce/xfdb/45077\");\n script_xref(name:\"URL\", value:\"http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno23/tabid/1176/Default.aspx\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif( ! port = get_app_port( cpe:CPE ) ) exit( 0 );\nif( ! vers = get_app_version( cpe:CPE, port:port ) ) exit( 0 );\n\nif( version_in_range( version:vers, test_version:\"2.0\", test_version2:\"4.8.4\" ) ) {\n\n report = report_fixed_ver( installed_version:vers, fixed_version:\"4.9.0\" );\n security_message( port:port, data:report );\n exit( 0 );\n} \n\nexit( 99 );", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}