GHSA-3m8r-w7xg-jqvw
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | DNN.PLATFORM | < 10.1.1 | 10.1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.
### Description
An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
References
External links from the advisory. They lead to third-party sites.