{"id":"CVE-2017-0929","aliases":["EUVD-2018-0600","GHSA-g8j6-m4p7-5rfq"],"status":"published","title":"High severity vulnerability that affects DotNetNuke.Core","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.12543,"percentile":0.96258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2018-07-03T21:00:00Z","modified":"2026-10-20T10:47:35Z","exploits":[{"source":"nuclei","id":"CVE-2017-0929","title":"DotNetNuke (DNN) ImageHandler \u003c9.2.0 - Server-Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-0929.yaml"}],"fixes":[{"ecosystem":"NuGet","package":"DotNetNuke.Core","fixed_in":["9.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0"}]}],"versions":["6.0.0","7.0.0","7.0.6.121","7.1.0","7.1.2","7.2.0.613","7.3.0.499","7.3.1.20","7.4.0.353","7.4.1.280","7.4.2.216","8.0.0.809","8.0.1.239","8.0.2.4","8.0.3.5","8.0.4.226","9.0.0.1002","9.0.1.142","9.1.0.367","9.1.1.129"]}],"products":[{"vendor":"dnnsoftware","product":"dotnetnuke"}],"references":[{"url":"https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e6383747692c507ef8b94c3","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0929","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g8j6-m4p7-5rfq","tags":["advisory"]},{"url":"https://github.com/dnnsoftware/Dnn.Platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-0929","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","status":"published","published":"2018-07-03T21:00:00Z","modified":"2024-09-16T22:45:56.088Z","updated_at":"2026-11-02T14:33:22.381225Z"}],"euvd":[{"id":"EUVD-2018-0600","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","status":"published","published":"2018-07-03T21:00:00Z","modified":"2024-09-16T22:45:56Z","updated_at":"2026-11-03T00:55:00.150098Z"}],"ghsa":[{"id":"GHSA-g8j6-m4p7-5rfq","title":"High severity vulnerability that affects DotNetNuke.Core","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","status":"published","published":"2018-10-16T17:18:12Z","modified":"2023-01-09T05:03:02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"nvd":[{"id":"CVE-2017-0929","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","status":"published","published":"2018-07-03T21:29:00.37Z","modified":"2026-06-17T00:58:32.72Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"CVE-2017-0929","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","status":"published","published":"2018-07-03T21:29:00.37Z","modified":"2026-10-20T10:47:35.967289331Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"GHSA-g8j6-m4p7-5rfq","title":"High severity vulnerability that affects DotNetNuke.Core","description":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","status":"published","published":"2018-10-16T17:18:12Z","modified":"2023-11-08T03:58:41.226325Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}