DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

CAO 7.5CVE-2025-32372 · GHSA-3f7v-qx94-666m · Công bố 09/04/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-32372 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng DotNetNuke.Core, dotnetnuke (dnnsoftware).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.38%, cao hơn 31.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.13.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
DotNetNuke.Core NuGet	`< 9.13.8`	`9.13.8`
dotnetnuke dnnsoftware	`< 9.13.8`	`9.13.8`

Mô tả

A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks.

Impact

This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls.

Mô tả của NVD

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.