CVE-2026-40305

Katalog CVE

CVSS 4.3 · Medium EPSS 0,31%

Kerentanan Improper Authorization pada dnnsoftware dotnetnuke. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m advisory vendor
• https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2 release notes