it's not a vulnerability - it's actually asp.net detecting an invalid character in the path as colons are not allowed in the URL except (optionally) after the domain when it indicates the port that should be used. asp.net detects invalid characters. You can see this defined in web.config's requestPathInvalidCharacters property (see https://msdn.microsoft.com/en-us/libr... for more details)

The exception generated looks like this - dnnsoftware.com has a global error handler page to capture the exception, log it and show an error page

Server Error in '/DNN_Platform' Application.

---

A potentially dangerous Request.Path value was detected from the client (:).

Stack Trace:

[HttpException (0x80004005): A potentially dangerous Request.Path value was detected from the client (:).] System.Web.HttpRequest.ValidateInputIfRequiredByConfig() +12716015 System.Web.PipelineStepManager.ValidateHelper(HttpContext context) +166