CVE-2008-6644: XSS
Published Apr 7, 2009
·Updated
Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO.
Affected Software
38 affected components
DotNetNuke DotNetNuke=4.8.2
DotNetNuke DotNetNuke=4.8.1
DotNetNuke DotNetNuke=2.1.1
DotNetNuke DotNetNuke=1.0.10e
DotNetNuke DotNetNuke=1.0.10d
DotNetNuke DotNetNuke=1.0.7
DotNetNuke DotNetNuke=4.5.2
DotNetNuke DotNetNuke<=4.8.3
DotNetNuke DotNetNuke=1.0.8
DotNetNuke DotNetNuke=1.0.6
DotNetNuke DotNetNuke=1.0.9
DotNetNuke DotNetNuke=3.0.8
DotNetNuke DotNetNuke=4.3.5
DotNetNuke DotNetNuke=2.1.2
DotNetNuke DotNetNuke=4.0
DotNetNuke DotNetNuke=3.0.11
DotNetNuke DotNetNuke=3.0.7
DotNetNuke DotNetNuke=3.3.5
DotNetNuke DotNetNuke=3.1.0
dnnsoftware Dotnetnuke<=4.8.3
dnnsoftware Dotnetnuke=1.0.6
dnnsoftware Dotnetnuke=1.0.7
dnnsoftware Dotnetnuke=1.0.8
dnnsoftware Dotnetnuke=1.0.9
dnnsoftware Dotnetnuke=1.0.10d
dnnsoftware Dotnetnuke=1.0.10e
dnnsoftware Dotnetnuke=2.1.1
dnnsoftware Dotnetnuke=2.1.2
dnnsoftware Dotnetnuke=3.0.7
dnnsoftware Dotnetnuke=3.0.8
dnnsoftware Dotnetnuke=3.0.11
dnnsoftware Dotnetnuke=3.1.0
dnnsoftware Dotnetnuke=3.3.5
dnnsoftware Dotnetnuke=4.0
dnnsoftware Dotnetnuke=4.3.5
dnnsoftware Dotnetnuke=4.5.2
dnnsoftware Dotnetnuke=4.8.1
dnnsoftware Dotnetnuke=4.8.2
Event History
Apr 7, 2009
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-6644?
CVE-2008-6644 is classified as a high severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2008-6644?
To fix CVE-2008-6644, upgrade to a version of DotNetNuke later than 4.8.3 that has addressed this vulnerability.
3
What versions of DotNetNuke are affected by CVE-2008-6644?
CVE-2008-6644 affects DotNetNuke versions 4.8.3 and earlier, including multiple earlier versions.
4
What kind of attack can be executed through CVE-2008-6644?
CVE-2008-6644 allows remote attackers to inject arbitrary web scripts or HTML into the application via the PATH_INFO variable.
5
Is there a workaround for CVE-2008-6644 if I cannot upgrade?
There are no documented workarounds for CVE-2008-6644; it is recommended to upgrade to a patched version.