Products

Evoq Content Overview Content Creation Workflow Asset Management Mobile Responsive Personalization Content Analytics SEO Integrations Security Website PerformanceEvoq Engage Overview Community Management  Dashboard  Analytics  Member Profile Gamification Advocate Marketing Community Engagement  Ideas  Answers  Discussions  Groups  Wikis  Events Mobile ReadyDNN Support PackagesEvoq: CMS FeaturesEvoq OnDemandCompare DNN's CMS Products

Solutions

Content Management SystemMulti-Channel PublishingDigital MarketingOnline Community ManagementIntranet Software SolutionOur CustomersPrime

Resources

Test DrivesSchedule A DemoDocumentation CenterWebinarsWhite PapersProduct ManualsRequest PricingData SheetsCase StudiesEvoq Preferred Products Content Management Ecommerce Forms Identity Management and Authentication Site Management Social Themes

Partners

DNN Partners Partner Directory Become a DNN Partner Partner Program Overview  Hosting  Implementation  ISV  Training  Competencies

Community

Participate Ask a Question Forums Community Showcase DNN MVP  Program Overview  Lifetime MVPs  Honorary MVPs Subscribe to DNN Digest Advisory Groups  Awareness Advisory Group  Developer Advisory Group  Partner Advisory Group  Technology Advisory GroupLearn Documentation Wiki Community Blog Video Library Project History Development RoadmapDownload DNN Store Language Packs Manuals Nightly BuildsSecurity Policies Security Center

Blog

About

News Press Releases News Coverage Press KitCareersContact DNN

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Vulnerability IssueVulnerability Issue
Previous
 
Next
New Post
2/23/2011 11:18 AM
 
Francisco Mendoza


www.datamark.net
Joined: 5/16/2006
Posts: 1

Hi we are using regular aspx pages, but we like to change to use DNN for our company. during auditory in our current web sites dectect below vulnerability,  my question is, DNN is protected to this vulnerability? where i can get related information  to security and vulnerabilities for DNN

The Vulnerability scan reads as follows:
Web Server Uses Plain Text Basic Authentication:

Using Readable Clear Text can help eavesdropping and thereby compromise confidentiality. An attacker can successfully exploit this issue when the 401 error is returned when authentication is required. Also, an attacker can find out that the Basic Authentication scheme is used using the WWW-authenticate header.

Regards
Fco.
 
New Post
2/25/2011 7:05 PM
 
cathal connolly


cathal connolly's Avatar

www.cathal.co.uk
Joined: 4/9/2003
Posts: 9676
that issue is actually a security best practice i.e. authentication should not happen via basic authentication. To support this you can use a different authentication scheme such as windows authentication or integrated authentication neither of which use plain text. If you're only concerned with protecting your authetication token you can use SSL (dotnetnuke supports requring SSL), or alternatively use an authentication provider such as active directory (which uses hashes and not plain text)
Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US
 
New Post
2/27/2011 4:19 AM
 
Store Integrator


Joined: 11/27/2007
Posts: 238
Hi,

You can purchase a scan from hackersafe or other company for about 250USD and run a security scan. I would like to see that DNN runs such check from different vendors. But the DNN team did not catch up this idea. I scanned PCI level 1 with hackersafe and they could not report any security related issue other that those stated by DNN. You can purchase such subscription and run the test yourself.

J.
 
New Post
2/27/2011 5:26 AM
 
Store Integrator


Joined: 11/27/2007
Posts: 238
Hi,
Weird thing. I am not able to trace the ip number of this event. Not in sitelog, not in server log (iis log), not in application error event log of server.
http://www.dotnetnuke.com/Resources/Forums/tabid/795/forumid/108/threadid/409479/scope/posts/Default.aspx
J.
 
New Post
3/23/2012 10:42 AM
 
Chris Wylie


Joined: 10/20/2003
Posts: 202
@ Cathal

Hi Cathal, we have had several requests for documentation on Security and Vulnerability for the DNN platform - both DNN Community and Pro. Does DNN have any coherent documentation on this? I've looked around and have only found a few short documents that were out of date.

Specifically things like Pentests, Compliance, Certifications.

Can you point me in the right direction?

Thanks,
Chris


Chris Wylie
Chief Executive Officer
www.AccordLMS.com
1775 W. State Street Suite 371, Boise ID 83702 USA
 
 
 Page 1 of 2
12Next 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Vulnerability IssueVulnerability Issue


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out