PT-2018-9705
CVE-2018-10138
·
تاريخ النشر
2018-04-16
·
تاريخ التحديث
2018-05-21
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
DNN (formerly DotNetNuke) CATALooK.netStore module versions through 7.2.8
Description:
The issue allows for XSS attacks via specific parameters in certain API endpoints. The affected endpoints include
/ViewEditGoogleMaps.aspx with the PortalID or CATSkin parameter, and /ImageViewer.aspx with the link or desc parameter.Recommendations:
For DNN (formerly DotNetNuke) CATALooK.netStore module versions through 7.2.8, consider disabling access to the
/ViewEditGoogleMaps.aspx and /ImageViewer.aspx endpoints until a patch is available. As a temporary workaround, restrict the use of the PortalID, CATSkin, link, and desc parameters in these endpoints to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾