DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

高 7.5CVE-2025-32372 · GHSA-3f7v-qx94-666m · 09/04/2025 公開 · 17/06/2026 更新

要点

CVE-2025-32372 は DotNetNuke.Core, dotnetnuke (dnnsoftware) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 31.9% より高い）。
対処：9.13.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
DotNetNuke.Core NuGet	`< 9.13.8`	`9.13.8`
dotnetnuke dnnsoftware	`< 9.13.8`	`9.13.8`

概要

A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks.

Impact

This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls.

NVD の説明

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.