CVE-2020-11585: Medium severity dnn (dotnetnuke) vulnerability

Published Apr 6, 2020

Updated

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

Affected Software

1 affected component

dnnsoftware Dotnetnuke=9.5.0

Event History

Apr 6, 2020

CVE Published

via MITRE·08:27 PM

Data Sourced

via MITRE·08:27 PM

Description

Frequently Asked Questions

What is CVE-2020-11585?

CVE-2020-11585 is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed module.

How severe is CVE-2020-11585?

The severity of CVE-2020-11585 is rated as medium with a CVSS score of 4.3.

What software versions are affected by CVE-2020-11585?

CVE-2020-11585 affects DNN (formerly DotNetNuke) version 9.5.0.

How can a registered user exploit CVE-2020-11585?

A registered user can exploit CVE-2020-11585 by enumerating any file in the Admin File Manager through the Activity-Feed/Messaging/Userid/ Message Center module.