DNN Platform contains a cross-site scripting vulnerability that allows high-privileged users to execute unauthorized scripts, posing a significant risk of administrative account compromise.

This is a cross-site scripting (CWE-79) flaw where a module friendly name is improperly sanitized. The vulnerability requires high privileges (PR:H) and user interaction to trigger, allowing for the execution of scripts in the context of the Persona Bar.

The exploitation of this vulnerability could lead to a complete compromise of administrative sessions, potentially resulting in unauthorized data access, system configuration changes, or full platform takeover. With a CVSS score of 7.6, the vulnerability is considered High, as it impacts the integrity and availability of the content management system, which is a critical asset for organizational web operations.

Immediate Action: Upgrade to DNN Platform version 9.13.10 or 10.2.0 to apply the necessary sanitization patches.

Proactive Monitoring: Review administrative audit logs for suspicious activity within the Persona Bar or unexpected modifications to module settings.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious inputs in module naming fields.

Public Exploit Available: No

Given the potential for administrative session hijacking, organizations should prioritize patching their DNN instances. Administrators are encouraged to verify their current version against the affected ranges and apply the recommended updates immediately to prevent potential exploitation.