CVE-2020-11585

2020-04-0621:15:13

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

CPENameOperatorVersion
dnn.platformeq9.4.0-rc0
dnn.platformeq9.4.3
dnn.platformeq9.5.0-rc1
dnn.platformeq9.4.2
dnn.platformeq9.4.1
dnn.platformeq9.2.1-rc1
dnn.platformeq9.3.1-rc0
dnn.platformeq9.5.0
dnn.platformeq9.2.2-rc0
dnn.platformeq9.2.1-rc0

Name	Operator	Version
dnn.platform	eq	9.4.0-rc0
dnn.platform	eq	9.4.3
dnn.platform	eq	9.5.0-rc1
dnn.platform	eq	9.4.2
dnn.platform	eq	9.4.1
dnn.platform	eq	9.2.1-rc1
dnn.platform	eq	9.3.1-rc0
dnn.platform	eq	9.5.0
dnn.platform	eq	9.2.2-rc0
dnn.platform	eq	9.2.1-rc0