Register | Log In
Store Download Support Blogs Forums Contact
News > Security Policy > security bulletin no.56

Module Permissions Editable by anyone with the URL

Published: Jun 27, 2011

Version: 1.0

Maximum Severity Rating: medium

Background

DotNetNuke support applying different permissions to modules and pages.

Issue Summary

If a user has edit permissions to a module, this incorrect grants them access to manage the module, allowing them to access all permissions and change them as desired.

Mitigating factors

User may have a valid account to login and must have edit permissions on a page or module.

Affected DotNetNuke versions

  • 5.6.0-5.6.1

Non-Affected Versions:

  • N/A

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (5.6.3 at time of writing)

Acknowledgments

Laurence Neville

Security Policy

Click here to read more details on the DotNetnuke Security Policy

Attend A Webinar
Free Demo Site
Download DotNetNuke Professional Edition Trial
Have Someone Contact Me
Have Someone Contact Me

DotNetNuke Corporation

DotNetNuke Corp. is the steward of the DotNetNuke open source project, the most widely adopted Web Content Management Platform for building web sites and web applications on Microsoft. Organizations use DotNetNuke to quickly develop and deploy interactive and dynamic web sites, intranets, extranets and web applications. The DotNetNuke platform is available in a free Community and subscription-based Professional and Enterprise Editions with an Elite Support option. DotNetNuke Corp. also operates the DotNetNuke Store where users purchase third party apps for the platform.
Copyright © 2002-2012 DotNetNuke Corp. / Terms of Use / Privacy
Hosted by MaximumASP