DNN Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in DNN (formerly DotNetNuke) versions prior to 10.1.0. This issue arises from the platform's URL/path handling and template rendering, which can allow specially crafted input to be reflected into a user profile and returned to the browser. The application fails to adequately neutralize or encode characters that hold significance in HTML, enabling an attacker to manipulate content that the victim's browser interprets as part of the page's HTML.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to DNN version 10.1.0 or later to address this vulnerability.