CVE-2020-11585

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module

published April 6, 2020

CVSS
—
EPSS
1%
Percentile
52.2
In the wild
Unconfirmed
What it is

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00688 · 52.2th percentile
Published
2020-04-06T20:27Z
EPSS history
Timeline
  • 06 APR 20:27Z
    There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module
    cvelistv5