GitHub Advisoryadvisory · NuGet

GHSA-3f7v-qx94-666m DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

MEDIUM Published 2025-04-09 Modified 2025-04-09 Official page ↗
Aliases
CVE-2025-32372
Ecosystem
NuGet
Packages
DotNetNuke.Core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-918
Reviewed
2025-04-09

Affected packages

• NuGet DotNetNuke.Core: < 9.13.8 → fixed in 9.13.8

Description

A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. Impact This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls.

Related

Alias · CVE (1)

  • CVE-2025-32372 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References