CVE-2012-1036: XSS
Published Apr 11, 2012
·Updated
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
Affected Software
43 affected components
DotNetNuke DotNetNuke<=5.6.3
DotNetNuke DotNetNuke=4.9.0
DotNetNuke DotNetNuke=4.9.1
DotNetNuke DotNetNuke=4.9.2
DotNetNuke DotNetNuke=4.9.3
DotNetNuke DotNetNuke=4.9.4
DotNetNuke DotNetNuke=4.9.5
DotNetNuke DotNetNuke=5.0.0
DotNetNuke DotNetNuke=5.0.1
DotNetNuke DotNetNuke=5.1.0
DotNetNuke DotNetNuke=5.1.1
DotNetNuke DotNetNuke=5.1.2
DotNetNuke DotNetNuke=5.1.3
DotNetNuke DotNetNuke=5.1.4
DotNetNuke DotNetNuke=5.2.0
DotNetNuke DotNetNuke=5.2.1
DotNetNuke DotNetNuke=5.2.2
DotNetNuke DotNetNuke=5.2.3
DotNetNuke DotNetNuke=5.3.0
DotNetNuke DotNetNuke=5.3.1
DotNetNuke DotNetNuke=5.4.0
DotNetNuke DotNetNuke=5.4.1
DotNetNuke DotNetNuke=5.4.2
DotNetNuke DotNetNuke=5.4.3
DotNetNuke DotNetNuke=5.4.4
DotNetNuke DotNetNuke=5.5.0
DotNetNuke DotNetNuke=5.5.1
DotNetNuke DotNetNuke=5.6.0
DotNetNuke DotNetNuke=5.6.1
DotNetNuke DotNetNuke=5.6.2
DotNetNuke DotNetNuke=6.0.0
DotNetNuke DotNetNuke=6.0.1
DotNetNuke DotNetNuke=6.0.2
dnnsoftware Dotnetnuke<=5.6.3
dnnsoftware Dotnetnuke=4.9.1
dnnsoftware Dotnetnuke=4.9.2
dnnsoftware Dotnetnuke=5.1.1
dnnsoftware Dotnetnuke=5.1.2
dnnsoftware Dotnetnuke=5.1.3
dnnsoftware Dotnetnuke=5.1.4
dnnsoftware Dotnetnuke=6.0.0
dnnsoftware Dotnetnuke=6.0.1
dnnsoftware Dotnetnuke=6.0.2
Event History
Apr 11, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·10:39 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-1036?
CVE-2012-1036 has a medium severity rating, allowing attackers to execute arbitrary scripting code in a victim's browser.
2
How do I fix CVE-2012-1036?
To fix CVE-2012-1036, upgrade DotNetNuke to version 5.6.4 or later, or 6.1.0 or later.
3
Which software versions are affected by CVE-2012-1036?
CVE-2012-1036 affects DotNetNuke versions prior to 5.6.4 and 6.x versions before 6.1.0.
4
What kind of attacks can exploit CVE-2012-1036?
CVE-2012-1036 can be exploited for cross-site scripting (XSS) attacks, allowing injection of malicious scripts.
5
Are there any known exploits for CVE-2012-1036?
Yes, there are known exploits for CVE-2012-1036 that target vulnerable installations of DotNetNuke.