DNN Unauthenticated File Upload Vulnerability in CKEditor Provider

A file upload vulnerability has been identified in DNN (formerly DotNetNuke) versions prior to 10.1.1. The issue arises in the default HTML editing experience, which allows unauthenticated users to upload files. This capability could lead to additional security problems and is unnecessary for most implementations. The vulnerability has been addressed in version 10.1.1.

Impact

Exploitation of this vulnerability allows unauthenticated users to upload files, which could be leveraged for further security issues.

Remediation

Users can upgrade to DNN version 10.1.1 or later to address this vulnerability. If there is a specific need to allow unauthenticated file uploads in an earlier version, the web.config file can be modified to remove the default upload block.