What’s Vulnerable › Vulnerabilities

CVE-2025-32372: Server-Side Request Forgery (SSRF) in DotNetNuke.Core

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-09 · updated 2026-06-17
• Weakness: CWE-918

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.

Affected products

• DotNetNuke CMS Fixed in 9.1.1: before 9.13.8 — fixed in 9.13.8

How to fix

Upgrade to a fixed version: DotNetNuke CMS Fixed in 9.1.1 9.13.8. Check the vendor advisory for mitigations.

References

• https://github.com/dnnsoftware/Dnn.Platform/commit/4721dd9eef846936d3b1a3676499e46968d15feb
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3f7v-qx94-666m

Get alerted when CVE-2025-32372 or the next vulnerability affects your stack