CVE-2013-4649 DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

What is CVE-2013-4649?

CVE-2013-4649 is a medium-severity cross-site scripting vulnerability in Dnnsoftware Dotnetnuke, published on 12 Mar 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.

Weakness: CWE-79

Which versions are affected by CVE-2013-4649?

4 open source packages ship an affected version, including DotNetNuke.Core. It affects 1 product.

Products include Dnnsoftware Dotnetnuke.

How do I fix CVE-2013-4649?

Upgrade DotNetNuke.Core to a fixed version for your release line: 6.2.9 or 7.1.1.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2013-4649 being exploited?

There is no known exploitation of CVE-2013-4649 in the wild and no public exploit code.

Other vulnerabilities in Dnnsoftware Dotnetnuke

• CVE-2017-9822 DotNetNuke (DNN) Remote Code Execution Exploited High 8.8
• CVE-2018-15811 DotNetNuke (DNN) Inadequate Encryption Strength Exploited High 7.5
• CVE-2018-18325 DotNetNuke (DNN) Inadequate Encryption Strength Exploited High 7.5
• CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite Critical 10.0
• CVE-2006-3601 Privilege escalation in n/a Critical 10.0

All Dnnsoftware Dotnetnuke vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rvrj-j7cc-236p.