CVE-2020-11585: Use of Insufficiently Random Values

April 6, 2020 (updated July 21, 2021)

There is an information disclosure issue in DNN (formerly DotNetNuke) within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

References

nvd.nist.gov/vuln/detail/CVE-2020-11585

Detect and mitigate CVE-2020-11585 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →