CVE-2025-32373

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32373
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vxcm-4rwh-chpc Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
History

26 Aug 2025, 00:44

Type Values Removed Values Added
Summary
  • (es) DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web (CMS) de código abierto del ecosistema de Microsoft. En configuraciones limitadas, los usuarios registrados podrían manipular una solicitud para enumerar o acceder a archivos del portal a los que no deberían tener acceso. Esta vulnerabilidad se corrigió en la versión 9.13.8.
CPE cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
First Time Dnnsoftware
Dnnsoftware dotnetnuke
References () https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vxcm-4rwh-chpc - () https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vxcm-4rwh-chpc - Vendor Advisory

09 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-09 16:15

Updated : 2025-08-26 00:44

NVD link : CVE-2025-32373

Mitre link : CVE-2025-32373

CVE.ORG link : CVE-2025-32373

JSON object : View

Products Affected

dnnsoftware

  • dotnetnuke
CWE
CWE-639

Authorization Bypass Through User-Controlled Key