CVE-2025-52487

HIGH

Dnnsoftware Dotnetnuke < 10.0.1 - Incorrect Authorization

Title source: rule

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP Addresses not in the allow list. This issue has been patched in version 10.0.1.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fjhg-3mrh-mm7h

Scores

CVSS v3 7.5

EPSS 0.0024

EPSS Percentile 47.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (2)

dnnsoftware/dotnetnuke 7.0.0 - 10.0.1

nuget/DNN.PLATFORM 7.0.0 - 10.0.1NuGet

Published Jun 21, 2025

Tracked Since Feb 18, 2026