CVE-2004-2323

CVE-2004-2323 describes an information disclosure vulnerability in DotNetNuke versions 1.0.6 through 1.0.10d. Remote attackers can exploit this flaw by making GET requests for sensitive configuration files like Web.config, potentially revealing critical information such as SQL server usernames and passwords. This vulnerability has a CVSS score of 5.0, indicating a medium severity, as it can be exploited remotely with low complexity and no authentication, leading to a partial compromise of confidentiality. Despite its age, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.