Register | Log In
Store Download Support Blogs Forums Contact
News > Security Policy > Security bulletin no39

update inputfilter blacklist for invalid tag that could allow XSS attack

Published: June 14, 2010

Version: 1.0

Maximum Severity Rating: Low

Background

DotNetNuke contains a number of functions that are used to sanitize user input..

Issue Summary

The blacklist function that is used to strip dangerous content that could lead to a cross-site scripting attack (XSS) did not contain a match for a particular string. If this string contained an invalid HTML tag, a XSS attack could occur.

Mitigating factors

N/A

Affected DotNetNuke versions

All

Non-Affected Versions:

N/A

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (5.4.3 at time of writing).


Acknowledgments

Chris Wood

Security Policy

Click here to read more details on the DotNetNuke Security Policy

Attend A Webinar
Free Demo Site
Download DotNetNuke Professional Edition Trial
Have Someone Contact Me

Like Us on Facebook Join our Network on LinkedIn Follow DNN Corporate on Twitter Follow DNN on Twitter

Advertisers

Sponsors

DotNetNuke Corporation

DotNetNuke Corp. is the steward of the DotNetNuke open source project, the most widely adopted Web Content Management Platform for building web sites and web applications on Microsoft .NET. Organizations use DotNetNuke to quickly develop and deploy interactive and dynamic web sites, intranets, extranets and web applications. The DotNetNuke platform is available in a free Community and subscription-based Professional and Enterprise Editions with an Elite Support option. DotNetNuke Corp. also operates Snowcovered.com where users purchase third party apps for the platform.
Copyright © 2002-2012 DotNetNuke Corp. / Terms of Use / Privacy
Hosted by MaximumASP