PT-2025-15704 · Dnn · Dnn

S0Nnywt · Published 2025-04-09 · Updated 2026-05-08 · CVE-2025-32372

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: DNN (formerly DotNetNuke) versions prior to 9.13.8

Description: A bypass has been identified for a previously known vulnerability, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This issue facilitates a semi-blind Server-Side Request Forgery (SSRF) attack, enabling attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance and bypassing firewalls.

Recommendations: For versions prior to 9.13.8, update to version 9.13.8 to resolve the issue. As a temporary workaround, consider restricting access to internal networks and URLs to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-07002

CVE-2025-32372

GHSA-3F7V-QX94-666M

Affected Products

Dnn

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32372.json · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3f7v-qx94-666m · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform/commit/4721dd9eef846936d3b1a3676499e46968d15feb · Patch
• https://osv.dev/vulnerability/GHSA-3f7v-qx94-666m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32372 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07002 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-32372 · Security Note
• https://github.com/dnnsoftware/Dnn.Platform · Note
• https://t.me/cveNotify/133382 · Telegram Post
• https://twitter.com/CVEnew/status/1910073455451472291 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1910016923577839944 · Twitter Post
• https://t.me/aptreports/28607 · Telegram Post