{"id":"CVE-2019-6714","published":"2019-03-17T17:40:33Z","modified":"2024-08-04T20:31:03Z","title":"An issue was discovered in BlogEngine.NET through 3.3.6.0","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.31725,"percentile":0.9829,"provenance":"source"},"cwes":[],"references":[{"url":"http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/46353/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://blogengine.io/","tags":["x_refsource_MISC"]},{"url":"https://github.com/rxtur/BlogEngine.NET/","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2019/Jun/26","tags":["mailing-list","x_refsource_FULLDISC"]}],"priority":{"score":24.7,"factors":[{"name":"EPSS percentile","points":19.66},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-02-12"},"first":{"date":"2019-02-12","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46353"},"provenance":"source"},"euvd":{"id":"EUVD-2019-16272","exploited":false,"provenance":"source"},"exploits":[{"id":46353,"url":"https://www.exploit-db.com/exploits/46353","title":"BlogEngine.NET 3.3.6 - Directory Traversal / Remote Code Execution","date":"2019-02-12","verified":true,"provenance":"source"}],"exploitRefs":["https://www.exploit-db.com/exploits/46353/","http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.html"],"lineage":{"familyId":"fam-cve-2019-6714-family-cve-2019-6714","children":[{"from":"CVE-2019-6714","to":"CVE-2019-10719","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.","from":"CVE.org","in":"CVE-2019-10719"}]},{"from":"CVE-2019-6714","to":"CVE-2019-10720","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.","from":"CVE.org","in":"CVE-2019-10720"}]}]}}