PT-2020-10153
CVE-2019-19392
·
تاريخ النشر
2020-01-21
·
تاريخ التحديث
2020-02-05
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
DNN (formerly DotNetNuke) forDNN.UsersExportImport module versions prior to 1.2.0
Description
The issue allows an unprivileged user to import new users with Administrator privileges by including specific roles in XML or CSV data, such as
Roles="Administrators".Recommendations
For versions prior to 1.2.0, update the forDNN.UsersExportImport module to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the user import functionality to prevent unauthorized creation of administrator accounts.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾