PT-2019-12007 · Blogengine.Net · Blogengine.Net

Irbishop

·

CVE-2019-10717

·

Publicado

2019-07-03

·

Atualizado

2019-07-10

CVSS v3.1

7.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions BlogEngine.NET version 3.3.7.0
Description The issue allows for Directory Traversal via the path parameter in the "/api/filemanager" API endpoint.
Recommendations For BlogEngine.NET version 3.3.7.0, avoid using the path parameter in the "/api/filemanager" API endpoint until the issue is resolved. Consider restricting access to this endpoint to minimize the risk of exploitation.

Exploit

Correção

DoS

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-10717

Produtos afetados

Blogengine.Net