CVE-2013-3943: XSS
First published: Wed Mar 12 2014(Updated: )
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
Credit: PSIRT-CNA@flexerasoftware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| DNN (DotNetNuke) | <=6.2.8 | |
| DNN (DotNetNuke) | =1.0.6 | |
| DNN (DotNetNuke) | =1.0.7 | |
| DNN (DotNetNuke) | =1.0.8 | |
| DNN (DotNetNuke) | =1.0.9 | |
| DNN (DotNetNuke) | =1.0.10d | |
| DNN (DotNetNuke) | =1.0.10e | |
| DNN (DotNetNuke) | =2.1.1 | |
| DNN (DotNetNuke) | =2.1.2 | |
| DNN (DotNetNuke) | =3.0.7 | |
| DNN (DotNetNuke) | =3.0.8 | |
| DNN (DotNetNuke) | =3.0.11 | |
| DNN (DotNetNuke) | =3.1.0 | |
| DNN (DotNetNuke) | =3.3.5 | |
| DNN (DotNetNuke) | =4.0 | |
| DNN (DotNetNuke) | =4.3.5 | |
| DNN (DotNetNuke) | =4.4.1 | |
| DNN (DotNetNuke) | =4.5.2 | |
| DNN (DotNetNuke) | =4.5.4 | |
| DNN (DotNetNuke) | =4.5.5 | |
| DNN (DotNetNuke) | =4.6.0 | |
| DNN (DotNetNuke) | =4.6.1 | |
| DNN (DotNetNuke) | =4.6.2 | |
| DNN (DotNetNuke) | =4.7.0 | |
| DNN (DotNetNuke) | =4.8.0 | |
| DNN (DotNetNuke) | =4.8.1 | |
| DNN (DotNetNuke) | =4.8.2 | |
| DNN (DotNetNuke) | =4.8.3 | |
| DNN (DotNetNuke) | =4.8.4 | |
| DNN (DotNetNuke) | =4.9 | |
| DNN (DotNetNuke) | =4.9.1 | |
| DNN (DotNetNuke) | =4.9.2 | |
| DNN (DotNetNuke) | =5.0 | |
| DNN (DotNetNuke) | =5.1 | |
| DNN (DotNetNuke) | =5.1.1 | |
| DNN (DotNetNuke) | =5.1.2 | |
| DNN (DotNetNuke) | =5.1.3 | |
| DNN (DotNetNuke) | =5.1.4 | |
| DNN (DotNetNuke) | =5.05.01 | |
| DNN (DotNetNuke) | =5.06.00 | |
| DNN (DotNetNuke) | =6.0.0 | |
| DNN (DotNetNuke) | =6.0.1 | |
| DNN (DotNetNuke) | =6.0.2 | |
| DNN (DotNetNuke) | =6.1.0 | |
| DNN (DotNetNuke) | =6.1.1 | |
| DNN (DotNetNuke) | =6.1.2 | |
| DNN (DotNetNuke) | =6.1.3 | |
| DNN (DotNetNuke) | =6.1.4 | |
| DNN (DotNetNuke) | =6.1.5 | |
| DNN (DotNetNuke) | =6.2.0 | |
| DNN (DotNetNuke) | =6.2.1 | |
| DNN (DotNetNuke) | =6.2.2 | |
| DNN (DotNetNuke) | =6.2.3 | |
| DNN (DotNetNuke) | =6.2.4 | |
| DNN (DotNetNuke) | =6.2.5 | |
| DNN (DotNetNuke) | =6.2.6 | |
| DNN (DotNetNuke) | =6.2.7 | |
| DNN (DotNetNuke) | =7.0.0 | |
| DNN (DotNetNuke) | =7.0.1 | |
| DNN (DotNetNuke) | =7.0.2 | |
| DNN (DotNetNuke) | =7.0.3 | |
| DNN (DotNetNuke) | =7.0.4 | |
| DNN (DotNetNuke) | =7.0.5 | |
| DNN (DotNetNuke) | =7.0.6 | |
| DNN (DotNetNuke) | =7.1.0 | |
| <=6.2.8 | ||
| =1.0.6 | ||
| =1.0.7 | ||
| =1.0.8 | ||
| =1.0.9 | ||
| =1.0.10d | ||
| =1.0.10e | ||
| =2.1.1 | ||
| =2.1.2 | ||
| =3.0.7 | ||
| =3.0.8 | ||
| =3.0.11 | ||
| =3.1.0 | ||
| =3.3.5 | ||
| =4.0 | ||
| =4.3.5 | ||
| =4.4.1 | ||
| =4.5.2 | ||
| =4.5.4 | ||
| =4.5.5 | ||
| =4.6.0 | ||
| =4.6.1 | ||
| =4.6.2 | ||
| =4.7.0 | ||
| =4.8.0 | ||
| =4.8.1 | ||
| =4.8.2 | ||
| =4.8.3 | ||
| =4.8.4 | ||
| =4.9 | ||
| =4.9.1 | ||
| =4.9.2 | ||
| =5.0 | ||
| =5.1 | ||
| =5.1.1 | ||
| =5.1.2 | ||
| =5.1.3 | ||
| =5.1.4 | ||
| =5.05.01 | ||
| =5.06.00 | ||
| =6.0.0 | ||
| =6.0.1 | ||
| =6.0.2 | ||
| =6.1.0 | ||
| =6.1.1 | ||
| =6.1.2 | ||
| =6.1.3 | ||
| =6.1.4 | ||
| =6.1.5 | ||
| =6.2.0 | ||
| =6.2.1 | ||
| =6.2.2 | ||
| =6.2.3 | ||
| =6.2.4 | ||
| =6.2.5 | ||
| =6.2.6 | ||
| =6.2.7 | ||
| =7.0.0 | ||
| =7.0.1 | ||
| =7.0.2 | ||
| =7.0.3 | ||
| =7.0.4 | ||
| =7.0.5 | ||
| =7.0.6 | ||
| =7.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-3943?
CVE-2013-3943 has a medium severity rating, indicating potential risks for cross-site scripting exploits.
How do I fix CVE-2013-3943?
To fix CVE-2013-3943, upgrade to DotNetNuke version 6.2.9 or higher for DNN 6.x and version 7.1.1 or higher for DNN 7.x.
Who is affected by CVE-2013-3943?
CVE-2013-3943 affects users of DotNetNuke versions prior to 6.2.9 and 7.x versions prior to 7.1.1.
What type of vulnerability is CVE-2013-3943?
CVE-2013-3943 is a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web scripts.
What components of DotNetNuke are impacted by CVE-2013-3943?
CVE-2013-3943 specifically impacts the Display Name field in the Manage Profile section of DotNetNuke.
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/weakness
- agent/references
- agent/remedy
- agent/author
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/event
- agent/tags
- vendor/dotnetnuke
- canonical/dnn (dotnetnuke)
- version/dnn (dotnetnuke)/6.2.8
- version/dnn (dotnetnuke)/1.0.6
- version/dnn (dotnetnuke)/1.0.7
- version/dnn (dotnetnuke)/1.0.8
- version/dnn (dotnetnuke)/1.0.9
- version/dnn (dotnetnuke)/1.0.10d
- version/dnn (dotnetnuke)/1.0.10e
- version/dnn (dotnetnuke)/2.1.1
- version/dnn (dotnetnuke)/2.1.2
- version/dnn (dotnetnuke)/3.0.7
- version/dnn (dotnetnuke)/3.0.8
- version/dnn (dotnetnuke)/3.0.11
- version/dnn (dotnetnuke)/3.1.0
- version/dnn (dotnetnuke)/3.3.5
- version/dnn (dotnetnuke)/4.0
- version/dnn (dotnetnuke)/4.3.5
- version/dnn (dotnetnuke)/4.4.1
- version/dnn (dotnetnuke)/4.5.2
- version/dnn (dotnetnuke)/4.5.4
- version/dnn (dotnetnuke)/4.5.5
- version/dnn (dotnetnuke)/4.6.0
- version/dnn (dotnetnuke)/4.6.1
- version/dnn (dotnetnuke)/4.6.2
- version/dnn (dotnetnuke)/4.7.0
- version/dnn (dotnetnuke)/4.8.0
- version/dnn (dotnetnuke)/4.8.1
- version/dnn (dotnetnuke)/4.8.2
- version/dnn (dotnetnuke)/4.8.3
- version/dnn (dotnetnuke)/4.8.4
- version/dnn (dotnetnuke)/4.9
- version/dnn (dotnetnuke)/4.9.1
- version/dnn (dotnetnuke)/4.9.2
- version/dnn (dotnetnuke)/5.0
- version/dnn (dotnetnuke)/5.1
- version/dnn (dotnetnuke)/5.1.1
- version/dnn (dotnetnuke)/5.1.2
- version/dnn (dotnetnuke)/5.1.3
- version/dnn (dotnetnuke)/5.1.4
- version/dnn (dotnetnuke)/5.05.01
- version/dnn (dotnetnuke)/5.06.00
- version/dnn (dotnetnuke)/6.0.0
- version/dnn (dotnetnuke)/6.0.1
- version/dnn (dotnetnuke)/6.0.2
- version/dnn (dotnetnuke)/6.1.0
- version/dnn (dotnetnuke)/6.1.1
- version/dnn (dotnetnuke)/6.1.2
- version/dnn (dotnetnuke)/6.1.3
- version/dnn (dotnetnuke)/6.1.4
- version/dnn (dotnetnuke)/6.1.5
- version/dnn (dotnetnuke)/6.2.0
- version/dnn (dotnetnuke)/6.2.1
- version/dnn (dotnetnuke)/6.2.2
- version/dnn (dotnetnuke)/6.2.3
- version/dnn (dotnetnuke)/6.2.4
- version/dnn (dotnetnuke)/6.2.5
- version/dnn (dotnetnuke)/6.2.6
- version/dnn (dotnetnuke)/6.2.7
- version/dnn (dotnetnuke)/7.0.0
- version/dnn (dotnetnuke)/7.0.1
- version/dnn (dotnetnuke)/7.0.2
- version/dnn (dotnetnuke)/7.0.3
- version/dnn (dotnetnuke)/7.0.4
- version/dnn (dotnetnuke)/7.0.5
- version/dnn (dotnetnuke)/7.0.6
- version/dnn (dotnetnuke)/7.1.0