ByteOS Network

CVE Vulnerability Details :

CVE-2025-48376

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-23 May, 2025 | 15:37

Updated At-23 May, 2025 | 15:59

▼CVE Numbering Authority (CNA)

Dnn.Platform's Site Import could use an external source with a crafted request

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue.

Affected Products

Vendor

ESW Operations, LLC ("DNN Software")

Product

Dnn.Platform

Versions

Affected

< 9.13.9

Problem Types

Type	CWE ID	Description
CWE	CWE-841	CWE-841: Improper Enforcement of Behavioral Workflow

Metrics

Version	Base score	Base severity	Vector
3.1	3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

References

Hyperlink	Resource
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-62mf-vhhw-xmf8	x_refsource_CONFIRM
https://github.com/dnnsoftware/Dnn.Platform/commit/13fb13ee76173c3467d7ee8d120b20ca7bd4fa63	x_refsource_MISC

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References