CVE-2025-32372 Server-Side Request Forgery (SSRF) in DotNetNuke.Core
Unauthenticated attackers can perform Server-Side Request Forgery to access internal networks and bypass firewalls in DNN CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-32372?
CVE-2025-32372 is a medium-severity server-side request forgery vulnerability in Dnnsoftware Dotnetnuke, published on 9 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
Weakness: CWE-918
Which versions are affected by CVE-2025-32372?
2 open source packages ship an affected version, including DotNetNuke.Core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
DotNetNuke.Core NuGet | All versions | 9.13.8 |
DotNetNuke.Core NuGet | All versions | 9.13.8 |
Products include Dnnsoftware Dotnetnuke.
How do I fix CVE-2025-32372?
Upgrade DotNetNuke.Core to 9.13.8 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-32372 being exploited?
There is no known exploitation of CVE-2025-32372 in the wild and no public exploit code.
Other vulnerabilities in Dnnsoftware Dotnetnuke
- CVE-2017-9822 DotNetNuke (DNN) Remote Code Execution
- CVE-2018-15811 DotNetNuke (DNN) Inadequate Encryption Strength
- CVE-2018-18325 DotNetNuke (DNN) Inadequate Encryption Strength
- CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
- CVE-2006-3601 Privilege escalation in n/a
Sources
Also known as GHSA-3f7v-qx94-666m.