CVE-2004-2323: Dnnsoftware DotNetNuke

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.

Affected products

• Dnnsoftware DotNetNuke: version 1.0.6 only; version 1.0.7 only; version 1.0.8 only; version 1.0.9 only; version 1.0.10d only

Published 2004-12-31. Last modified 2026-06-16.