Published: Nov 26, 2009

Edited: Feb 4 2010 (updated Urlscan URL)

Version: 1.0

Maximum Severity Rating: Low

Background

DotNetNuke has a search function which redirects to a custom results page.

Issue Summary

Whilst the search function filters for dangerous script , recently code was added to show the search terms and this failed to filter. The code has been refactored to filter the input to ensure that cross-site scripting attacks cannot occur.

Mitigating factors

To protect against attacks that attempt to use invalid URL's, users can install the free Microsoft URLScan utility(http://www.iis.net/expand/UrlScan). This is a recommended install as it offers protection against a number of other non-DotNetNuke specific URL based issues.

Affected DotNetNuke versions

4.8 - 5.1.4

Non-Affected Versions:

N/A

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (5.2.0 at time of writing)

Acknowledgments

Scott Bell, Security Consultant, Security-Assessment.com

Security Policy

Click here to read more details on the DotNetNuke Security Policy