DNN Stored Cross-Site Scripting Vulnerability via SVG Upload

A stored cross-site scripting vulnerability has been identified in DNN (formerly DotNetNuke) versions prior to 10.2.2. This issue allows users to upload specially crafted SVG files containing scripts that can execute and target both authenticated and unauthenticated DNN users. The risk is heightened if the scripts are executed by a power user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files with embedded scripts are executed in the context of the user.

Remediation

Users can upgrade to DNN version 10.2.2, which addresses this vulnerability. Instructions for upgrading DNN can be found in the DNN documentation.