Hello,

My PCI scan vendor reported cross site scripting security vulnerability (as high security vulnerability) and reported the site status as NON PCI compliant. We are currently on dnn 4.4.1 version and it seems like there is no patch and only option is to upgrade to 5.2. Is any one having this issue? Do we have any work around (patch)  to resolve this issue other than upgrading to 5.2? I really appreciate your help.

Here is the message from scans: "

Cross Site Scripting and Information Disclosure Vulnerabilities

12/18/09 CVE 2009-4109 CVE 2009-4110 DotNetNuke before 5.2 is prone to cross-site scripting and information-disclosure vulnerabilities. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also obtain sensitive information. "

Thanks