CVE-2013-4649
DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter
EPSS 0.27%
Description
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
How to fix CVE-2013-4649
To remediate CVE-2013-4649, upgrade the affected package to a fixed version below.
- NuGet/DotNetNuke.Core—upgrade to 6.2.9 or later
Is CVE-2013-4649 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 6.2.9