search

UpendoVentures / Upendo-DNN-Simple-Auth-Provider

This extension for DNN allows you to switch from the default DNN login, to use a more user-friendly approach that requires entering a code from your email account.
https://upendoventures.com/What/CMS/DNN
MIT License
2 stars 1 forks source link

DotNetNuke-9.10.0.0.dll: 1 vulnerabilities (highest severity is: 4.9) #59

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago
Vulnerable Library - DotNetNuke-9.10.0.0.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.10.0.nupkg

Path to vulnerable library: /Modules/UpendoDnnSimpleAuthProvider/packages/DotNetNuke.Core.9.10.0/lib/net45/DotNetNuke.dll

Found in HEAD commit: 2db70b6cdbcc474cf1a7e2a73f7d20f87c3af815

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (DotNetNuke version) Remediation Possible**
CVE-2022-2922 Medium 4.9 DotNetNuke-9.10.0.0.dll Direct DotNetNuke.Core - 9.11.0, DotNetNuke.Web - 9.11.0 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-2922 ### Vulnerable Library - DotNetNuke-9.10.0.0.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.10.0.nupkg

Path to vulnerable library: /Modules/UpendoDnnSimpleAuthProvider/packages/DotNetNuke.Core.9.10.0/lib/net45/DotNetNuke.dll

Dependency Hierarchy: - :x: **DotNetNuke-9.10.0.0.dll** (Vulnerable Library)

Found in HEAD commit: 2db70b6cdbcc474cf1a7e2a73f7d20f87c3af815

Found in base branch: dev

### Vulnerability Details

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.

Publish Date: 2022-09-30

URL: CVE-2022-2922

### CVSS 3 Score Details (4.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-9w72-2f23-57gm

Release Date: 2022-09-30

Fix Resolution: DotNetNuke.Core - 9.11.0, DotNetNuke.Web - 9.11.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)