CVE-2009-4109: Infoleak
Published Nov 28, 2009
·Updated
The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.
Affected Software
48 affected components
DotNetNuke DotNetNuke=4.0
DotNetNuke DotNetNuke=4.3.5
DotNetNuke DotNetNuke=4.4.1
DotNetNuke DotNetNuke=4.5.2
DotNetNuke DotNetNuke=4.5.4
DotNetNuke DotNetNuke=4.5.5
DotNetNuke DotNetNuke=4.6.0
DotNetNuke DotNetNuke=4.6.1
DotNetNuke DotNetNuke=4.6.2
DotNetNuke DotNetNuke=4.7.0
DotNetNuke DotNetNuke=4.8.0
DotNetNuke DotNetNuke=4.8.1
DotNetNuke DotNetNuke=4.8.2
DotNetNuke DotNetNuke=4.8.3
DotNetNuke DotNetNuke=4.8.4
DotNetNuke DotNetNuke=4.9
DotNetNuke DotNetNuke=4.9.1
DotNetNuke DotNetNuke=4.9.2
DotNetNuke DotNetNuke=5.0
DotNetNuke DotNetNuke=5.1
DotNetNuke DotNetNuke=5.1.1
DotNetNuke DotNetNuke=5.1.2
DotNetNuke DotNetNuke=5.1.3
DotNetNuke DotNetNuke=5.1.4
dnnsoftware Dotnetnuke=4.0
dnnsoftware Dotnetnuke=4.3.5
dnnsoftware Dotnetnuke=4.4.1
dnnsoftware Dotnetnuke=4.5.2
dnnsoftware Dotnetnuke=4.5.4
dnnsoftware Dotnetnuke=4.5.5
dnnsoftware Dotnetnuke=4.6.0
dnnsoftware Dotnetnuke=4.6.1
dnnsoftware Dotnetnuke=4.6.2
dnnsoftware Dotnetnuke=4.7.0
dnnsoftware Dotnetnuke=4.8.0
dnnsoftware Dotnetnuke=4.8.1
dnnsoftware Dotnetnuke=4.8.2
dnnsoftware Dotnetnuke=4.8.3
dnnsoftware Dotnetnuke=4.8.4
dnnsoftware Dotnetnuke=4.9
dnnsoftware Dotnetnuke=4.9.1
dnnsoftware Dotnetnuke=4.9.2
dnnsoftware Dotnetnuke=5.0
dnnsoftware Dotnetnuke=5.1
dnnsoftware Dotnetnuke=5.1.1
dnnsoftware Dotnetnuke=5.1.2
dnnsoftware Dotnetnuke=5.1.3
dnnsoftware Dotnetnuke=5.1.4
Event History
Nov 28, 2009
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Nov 29, 2009
Data Sourced
via NVD·01:08 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-4109?
CVE-2009-4109 is categorized as a medium severity vulnerability due to information disclosure risks.
2
How do I fix CVE-2009-4109?
To mitigate CVE-2009-4109, update to a fixed version of DotNetNuke that addresses the vulnerability.
3
What type of attack does CVE-2009-4109 allow?
CVE-2009-4109 allows remote attackers to access sensitive version information of the software.
4
Which versions of DotNetNuke are affected by CVE-2009-4109?
CVE-2009-4109 affects DotNetNuke versions from 4.0 to 5.1.4.
5
Can anonymous users exploit CVE-2009-4109?
Yes, CVE-2009-4109 allows anonymous users to access the install wizard and potentially expose sensitive information.