1. Home
  2. CVE Database
  3. CVE-2019-12562
MEDIUM · 6.1

CVE-2019-12562

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perf...

Vulnerability Description

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
DnnsoftwareDotnetnuke< 9.4.0

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2019-12562?

CVE-2019-12562 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perf...

How severe is CVE-2019-12562?

CVE-2019-12562 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-12562?

Check the references section above for vendor advisories and patch information. Affected products include: Dnnsoftware Dotnetnuke.