Information disclosure

2020-04-0621:15:00

PRIOn knowledge base

www.prio-n.com

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

CPENameOperatorVersion
dotnetnukeeq9.5.0

CPE	Name	Operator	Version
	dotnetnuke	eq	9.5.0

References

neff.blog/2020/04/04/dotnetnuke-9-5-file-path-information-disclosure/