PT-2023-15146
CVE-2022-47053
·
Published
2023-04-12
·
Updated
2023-04-19
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
DNN Corp DotNetNuke versions 7.0.0 through 9.10.2
Description
An arbitrary file upload vulnerability in the Digital Assets Manager module allows attackers to execute arbitrary code via a crafted SVG file.
Recommendations
For versions 7.0.0 through 9.10.2, update to a version that fixes the arbitrary file upload vulnerability in the Digital Assets Manager module to prevent execution of arbitrary code via crafted SVG files.
As a temporary workaround, consider disabling the Digital Assets Manager module until a patch is available.
Found an issue in the description? Have something to add? Feel free to write us 👾