CVE-2009-4109

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-11-29 · updated 2026-06-16
Weakness: CWE-200

Description

The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.

Affected products

DotNetNuke CMS Fixed in 9.1.1: 4.0, 4.3.5, 4.4.1, 4.5.2, 4.5.4, 4.5.5 (+18)

References

http://osvdb.org/60520
http://secunia.com/advisories/37480
http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx
http://www.securityfocus.com/bid/37139
http://osvdb.org/60520
http://secunia.com/advisories/37480
http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx
http://www.securityfocus.com/bid/37139

Get alerted when CVE-2009-4109 or the next vulnerability affects your stack