Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2025-52488: DNN Platform could reveal NTLM password hashes
CVE-2025-52488 · published 1 year ago
Summary
Versions of DNN Platform from 6.0.0 up to before 10.0.1 may send Windows password hashes to a malicious SMB file share when given specially crafted input. An attacker who controls the share could capture those hashes and potentially use them to access other systems. Upgrade to DNN Platform 10.0.1 or later to stop the leak.
What to do
- Update dnn corporation dnn.platform to version 10.0.1.
- Update dnnsoftware dotnetnuke to version 10.0.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | dnn corporation | dnn.platform |
>= 6.0.0, < 10.0.1 Fix: upgrade to 10.0.1
|
| – | dnnsoftware | dotnetnuke |
>= 6.0.0, < 10.0.1 cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:* |
Original advisory text
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
References
- https://github.com/advisories/GHSA-mgfv-2362-jq96
- https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-52488 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52488... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published21 Jun 2025
Updated20 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta