Published: November 16, 2006
Version: 1.0
Maximum Severity Rating: Low
Background
When users are attempting to access portal functions, we strive to strike a balance between providing informative messages, but not revealing unnecessary detail to people attempting to profile the application.
Issue Summary
Two areas have been altered to fix issues where more information that was necessary was made available.
- When attempting to access a a page that the user does not have permission to, the user is correctly redirected to the login page. However, the page title preserves the name of the originally requested page, which has been determined to be an unnecessary information leakage.
- When logged in, if the user attempts to access another users profile, they are correctly redirected to a failure page. However, at that point the user can tell by the error message if the user account they tried to access is a standard user or a superuser.
Mitigating factors
N/A
Affected DotNetNuke versions
Non-Affected Versions:
Fix(s) for issue
To fix this problem, you are recommended to update to the latest version of DotNetNuke (3.3.6/4.3.6 at time of writing)
Acknowledgments
DotNetNuke thanks the following for working with us to help protect users:
- Christiaan Mellars of Risborrow Information Systems Ltd.
Security Policy
Click here to read more details on the DotNetnuke Security Policy