CVE-2025-32372CWE-918

Server-Side Request Forgery (SSRF) in DotNetNuke.Core

Medium · published April 9, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-04-09T15:14Z
EPSS history
Timeline
  • 09 APR 15:14Z
    Server-Side Request Forgery (SSRF) in DotNetNuke.Core
    cvelistv5