Published: May 18, 2010
Version: 1.0
Maximum Severity Rating: Low
Background
DotNetNuke has an install wizard to support installing and configuring instances.
Issue Summary
The install wizard has code which evaluates the database connection string and provides error details if a connection cannot be made. Under rare circumstances such as the sql server not being available it is possible to invoke the wizard and navigate to a screen that checks the connection. Once the connection fails the sql exception details are shown which can contain sensitive information such as the database name or the username that is attempting to connect.
Whilst this issue may reveal valuable information it is not easily exploitable, requiring 3rd party software to not perform or a full denial of sevice attack to cause the system to break, the issue has been rated as Low.
Mitigating factors
This issue can only manifest in the case of the database becoming unavailable.
Affected DotNetNuke versions
Non-Affected Versions:
Fix(s) for issue
To fix this problem, you are recommended to update to the latest version of DotNetNuke (5.4.2 at time of writing)
Acknowledgments
PowerDNN Engineering Team
Security Policy
Click here to read more details on the DotNetnuke Security Policy