Published: Nov 26, 2009
Version: 1.0
Maximum Severity Rating: Low
Background
DotNetNuke has an install wizard to support installing and configuring instances.
Issue Summary
The install wizard has code which evaluates the database and assembly versions to determine if an upgrade is required. It is possible to view this information as an anonymous user.This information could be useful to hackers attempting to profile an application.
As the information is important it will still show if the versions differ, but if they are in sync which is the normal case, the version is not revealed.
Mitigating factors
N/a
Affected DotNetNuke versions
Non-Affected Versions:
Fix(s) for issue
To fix this problem, you are recommended to update to the latest version of DotNetNuke (5.2.0 at time of writing)
Acknowledgments
Dan Gilleland, Dynamic Generation Inc.
Security Policy
Click here to read more details on the DotNetnuke Security Policy