CVE-2025-32372
Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
How to fix
- dnnsoftware dotnetnuke9.13.8 or later
- DotNetNuke.Core9.13.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dnnsoftware dotnetnuke | v < 9.13.8 | 9.13.8 |
| DotNetNuke.CoreNuGet | v < 9.13.8 | 9.13.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.