{"id":"CVE-2017-0929","published":"2018-07-03T21:00:00Z","modified":"2024-09-16T22:45:56Z","title":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.12543,"percentile":0.96218,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-09-19","exploitedFirstSeen":"2024-09-19","ransomware":false,"evidence":[{"url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","date":"2024-09-19"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/botpoke-scanner-switches-ip","date":"2024-11-25"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389","date":"2025-01-21"},{"url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","date":"2025-03-11"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-How-Resurgent-Vulnerabilities-Jeopardize-Organizational-Security-Report.pdf","date":"2025-04-23"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e6383747692c507ef8b94c3","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"NuGet","package":"DotNetNuke.Core","vulnerableRanges":["<9.2.0"],"patched":["9.2.0"],"from":["GHSA-g8j6-m4p7-5rfq"],"provenance":"source"}],"advisories":[{"id":"GHSA-g8j6-m4p7-5rfq","url":"https://github.com/advisories/GHSA-g8j6-m4p7-5rfq","severity":"HIGH","ecosystem":"NuGet","package":"DotNetNuke.Core","vulnerableRanges":["<9.2.0"],"patched":["9.2.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0600","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0600","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2017-0929","name":"DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery","severity":"high","path":"http/cves/2017/CVE-2017-0929.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-0929.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2018-07-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-0929","provenance":"source"},{"date":"2024-09-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":59.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 770 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.24,"detail":"percentile 0.9622"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2015-2794","published":"2017-02-06","fixed":"7.4.1","kev":false},{"cve":"CVE-2016-7119","published":"2016-08-31","fixed":"8.0.1","kev":false},{"cve":"CVE-2017-9822","published":"2017-07-20","fixed":"9.1.1","kev":true,"link":{"from":"CVE-2017-9822","to":"CVE-2017-0929","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:DotNetNuke.Core","fromFixed":"9.1.1","toFixed":"9.2.0","daysApart":348}]}},{"cve":"CVE-2017-0929","published":"2018-07-03","fixed":"9.2.0","kev":false},{"cve":"CVE-2018-15811","published":"2019-07-03","fixed":"9.2.2","kev":true,"link":{"from":"CVE-2017-0929","to":"CVE-2018-15811","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:DotNetNuke.Core","fromFixed":"9.2.0","toFixed":"9.2.2","daysApart":365}]}},{"cve":"CVE-2018-15812","published":"2019-07-03","fixed":"9.2.2","kev":false,"link":{"from":"CVE-2017-0929","to":"CVE-2018-15812","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:DotNetNuke.Core","fromFixed":"9.2.0","toFixed":"9.2.2","daysApart":365}]}},{"cve":"CVE-2018-18325","published":"2019-07-03","fixed":"9.3.0","kev":true}],"package":"NuGet:DotNetNuke.Core"}}