CVE-2025-32372: Server-Side Request Forgery (SSRF) in DotNetNuke.Core
A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks.
Impact
This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls.
Other sources
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32372?
CVE-2025-32372 has been classified as a high-severity vulnerability due to its ability to allow unauthenticated attackers to execute arbitrary GET requests.
How do I fix CVE-2025-32372?
To mitigate CVE-2025-32372, upgrade to DotNetNuke.Core version 9.13.8 or later.
What types of systems are affected by CVE-2025-32372?
CVE-2025-32372 affects systems utilizing vulnerable versions of DotNetNuke.Core, enabling semi-blind SSRF attacks.
Can CVE-2025-32372 affect adjacent networks?
Yes, CVE-2025-32372 can be exploited to allow attackers to make requests to both internal and adjacent networks.
Is authentication required to exploit CVE-2025-32372?
No, CVE-2025-32372 can be exploited by unauthenticated attackers.