I only run a few community sites on DNN but someone asked me about how secure some of the open source platforms were.  I knew that DNN was very good but I didn't have anything solid other than people just saying so.  The person asking me was interested in Drupal and Joomla in particular but CMS's in general.

So I went to the National Vulnerability Database at http://nvd.nist.gov/ to check things out.  Here's what I found when I went to the Vulnerabilities page and searched for Drupal, Joomla and DotNetNuke.

Drupal - 104 security concerns, 42 within the last year

Joomla - 213 security concerns, 125 within the last year

DotNetNuke - 7 security concerns, 0 within the last year

Looks really good, but before I "report back" to my friend, I've got a question. 

I'm not sure if the security vulnerabilities for Drupal and Joomla include all the community modules or if it is just the core.  Same with DotNetNuke.  I am not familiar with Drupal and Joomla to see if this is comparing apples to oranges.  I am hoping that someone who has looked at Drupal or Joomla would be able to recognize what components/modules/add-ons are part of the core offering (or maybe everything was core).

Anyone else want to take a look?

PHP applications are notorious for their security issues, however that can be mitigated by doing a proper security review, both by the development team, and the team doing an implementation.  The DotNetNuke team is fortunate to have a security team headed by Cathal Connolly that reviews our code before we ship and we have recieved a couple of reports from various security audits over the years that has allowed us to further harden DotNetNuke and the core module.  This allows us to catch almost all of our security holes before anything gets into the wild.  Also, I would not read anything into the vulnerability lists at Secunia, Bugtraq or CVE as they are only updated by security research firms who may not provide even coverage across all applications.  As a platform becomes more popular it obviously will get more scrutiny. 

From scanning the various security lists it is clear that vulnerabilities have been reported on both the core platforms as well as common modules, what is unclear is how many of the Joomla and Drupal modules actually ship with the product or are just made available from the project website.