Published: September 09, 2008
Version: 1.0
Maximum Severity Rating: Critical
Background
When a user is logged in when they access user functions a unique id is used to ensure that these functions are performed for the correct user.
Issue Summary
Due to a weakness is validating the user identity it is possible for a potential hacker to access other user's account leading. This means that a hacker could impersonate other users or perform an escalation attack by accessing a user such as the admin or host user.
Mitigating factors
A potential hacker must have a valid, authorized user account on the DotNetNuke portal so that they can then attempt to access other users functions. If you do not have any additional users on your portals (e.g. sites where a user is both admin and host user and no other users exist), then this is not an issue. If you have additional users the risk of user permission escalation or impersonation exists.
Affected DotNetNuke versions
Non-Affected Versions:
Fix(s) for issue
To fix this problem, you are recommended to update to the latest version of DotNetNuke (4.9.0 at time of writing)
Acknowledgments
DotNetNuke thanks the following for working with us to help protect users:
Security Policy
Click here to read more details on the DotNetnuke Security Policy