DNN File Browser JavaScript Injection Vulnerability Allowing Reflected Cross-Site Scripting

A reflected cross-site scripting vulnerability has been identified in DNN (formerly DotNetNuke) versions prior to 10.1.0. This issue arises from the FileBrowser's handling of specially crafted URLs, which can inject JavaScript that executes when an unsuspecting user clicks the link. The injected script could be used for social engineering or more harmful actions, especially if the user has elevated permissions.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected JavaScript is executed in the context of the user's browser.

Remediation

Users can upgrade to DNN version 10.1.0 or later to address this vulnerability.