CVE-2020-5186 - Medium Severity Vulnerability
Vulnerable Libraries - dotnetnuke.core.9.7.0.nupkg, dotnetnuke.core.9.2.1.533.nupkg
dotnetnuke.core.9.7.0.nupkg
Provides basic references to the DotNetNuke.dll to develop extensions for the DNN Platform. For MVC or WebAPI please see other packages available as well
Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.7.0.nupkg
Path to dependency file: /Libraries/UpendoProvidersFipsAesCryptoProvider/Upendo.Libraries.UpendoProvidersFipsAesCryptoProvider.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/dotnetnuke.core/9.7.0/dotnetnuke.core.9.7.0.nupkg,/netnuke.core/9.7.0/dotnetnuke.core.9.7.0.nupkg
Dependency Hierarchy:
- ❌ dotnetnuke.core.9.7.0.nupkg (Vulnerable Library)
dotnetnuke.core.9.2.1.533.nupkg
DNN Platform is an open source web application framework.
This package contains only the core DNN Platform library.
Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.2.1.533.nupkg
Path to dependency file: /Libraries/UpendoProvidersFipsAesCryptoProvider/Upendo.Libraries.UpendoProvidersFipsAesCryptoProvider.csproj
Path to vulnerable library: /netnuke.core/9.2.1.533/dotnetnuke.core.9.2.1.533.nupkg
Dependency Hierarchy:
- ❌ dotnetnuke.core.9.2.1.533.nupkg (Vulnerable Library)
Found in HEAD commit: d6abd56cf0fd6b2d3d2037d2844bf7d7d130c52c
Found in base branch: development
Vulnerability Details
DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
Publish Date: 2020-02-24
URL: CVE-2020-5186
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Step up your Open Source Security Game with Mend here
CVE-2020-5186 - Medium Severity Vulnerability
dotnetnuke.core.9.7.0.nupkg
Provides basic references to the DotNetNuke.dll to develop extensions for the DNN Platform. For MVC or WebAPI please see other packages available as well
Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.7.0.nupkg
Path to dependency file: /Libraries/UpendoProvidersFipsAesCryptoProvider/Upendo.Libraries.UpendoProvidersFipsAesCryptoProvider.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/dotnetnuke.core/9.7.0/dotnetnuke.core.9.7.0.nupkg,/netnuke.core/9.7.0/dotnetnuke.core.9.7.0.nupkg
Dependency Hierarchy:
dotnetnuke.core.9.2.1.533.nupkg
DNN Platform is an open source web application framework. This package contains only the core DNN Platform library.
Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.2.1.533.nupkg
Path to dependency file: /Libraries/UpendoProvidersFipsAesCryptoProvider/Upendo.Libraries.UpendoProvidersFipsAesCryptoProvider.csproj
Path to vulnerable library: /netnuke.core/9.2.1.533/dotnetnuke.core.9.2.1.533.nupkg
Dependency Hierarchy:
Found in HEAD commit: d6abd56cf0fd6b2d3d2037d2844bf7d7d130c52c
Found in base branch: development
DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
Publish Date: 2020-02-24
URL: CVE-2020-5186
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here