Server-Side Request Forgery Vulnerability in DNN by DNN Corp
CVE-2017-0929

7.5HIGH

Key Information:

Vendor

Dnnsoftware

Status
Dotnetnuke
Vendor
CVE Published:
3 July 2018

What is CVE-2017-0929?

DNN (DotNetNuke) versions prior to 9.2.0 are susceptible to a Server-Side Request Forgery vulnerability in the DnnImageHandler class. This flaw allows attackers to potentially exploit the application and gain unauthorized access to sensitive information about internal network resources, posing risks to the security and confidentiality of data. It is crucial for users to update to the latest version to mitigate this vulnerability.

References

https://github.com/dnnsoftware/Dnn.Platform/commit/d3953d...
x_refsource_MISC

EPSS Score

91% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.