CVE-2012-1030: XSS
Published Apr 11, 2012
·Updated
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
Affected Software
6 affected components
DotNetNuke DotNetNuke=6.0.0
DotNetNuke DotNetNuke=6.0.1
DotNetNuke DotNetNuke=6.0.2
dnnsoftware Dotnetnuke=6.0.0
dnnsoftware Dotnetnuke=6.0.1
dnnsoftware Dotnetnuke=6.0.2
Event History
Apr 11, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·10:39 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-1030?
The severity of CVE-2012-1030 is considered medium due to potential for user-assisted exploitation.
2
How do I fix CVE-2012-1030?
To fix CVE-2012-1030, upgrade DotNetNuke to version 6.0.3 or later where the vulnerability is addressed.
3
What versions of DotNetNuke are affected by CVE-2012-1030?
CVE-2012-1030 affects DotNetNuke versions 6.0.0 through 6.0.2.
4
What kind of attack does CVE-2012-1030 enable?
CVE-2012-1030 enables cross-site scripting (XSS) attacks through crafted URLs.
5
Who can exploit CVE-2012-1030?
CVE-2012-1030 can be exploited by remote attackers with user assistance, such as phishing.