Register | Log In
Download Contact
News > Security Policy > Security bulletin no.64

DotNetNuke Store

Radeditor provider function could confirm the existence of a file

Published: Feb 1, 2012

Version: 1.0

Maximum Severity Rating: Low

Background

DotNetNuke 6.0 introduced the DotNetNuke.RadEditorProvider in 6.0. It contains a function which allows users to test for the existence of files - this function is primarily used to detect by clientside scripts to detect the existance of images e.g. for image thumbnails

Issue Summary

The function uses direct filesystem methods to check for these files existence and not the DotNetNuke API so it can allow for the existence of a file with an unmapped extension to be made e.g. a .resources or .config file. Code has been added to ensure that only image types can be used.

Mitigating factors

This issue only allows for the existence of a file to be confirmed and does not allow the file to be read or altered. 

Affected DotNetNuke versions

  • 6.0.0 - 6.1.2

Non-Affected Versions:

  • Versions prior to 6.0.0

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (6.1.3 at time of writing)

Acknowledgments

Brandon Haynes

Security Policy

Click here to read more details on the DotNetnuke Security Policy

Attend A Webinar
Start Professional Edition Trial
Have Someone Contact Me

DotNetNuke Corporation

DotNetNuke (DNN) provides a suite of solutions that make designing, building and managing feature-rich sites and communities fast, easy and cost-effective. The DotNetNuke Platform CMS is the foundation for more than one million websites worldwide. DNN Social, our newest solution, enables businesses to create immersive, interactive communities. Thousands of organizations like True Value Hardware, Bose, Cornell University, Glacier Water, Dannon, Delphi, USAA, NASCAR, Northern Health and the City of Denver have leveraged DNN to deploy highly engaging business- critical websites. Our rapid growth in product sales and deployments resulted in DotNetNuke Corp. being named one of the fastest growing private companies in America by Inc. Magazine in 2011 and 2012.
Copyright © 2002-2013 DotNetNuke Corp. / Terms of Use / Privacy
Hosted by MaximumASP