What is CVE-2025-32372?

CVE-2025-32372 is a medium-severity vulnerability in Dnnsoftware Dnn.platform, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2025-04-09.

How severe is CVE-2025-32372?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SSRF in Dnnsoftware Dnn.platform

CVE-2025-32372

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Dnnsoftware Dnn.platform — versions < 9.13.8
Dnnsoftware Dotnetnuke

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-32372?: CVE-2025-32372 is a medium-severity vulnerability in Dnnsoftware Dnn.platform, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2025-04-09.
How severe is CVE-2025-32372?: Medium severity. CVSS v3 base score is 6.5 out of 10.