CVE-2019-10719
moderate-risk
Published 2019-06-21
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
Do I need to act?
~
7.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (1)
Blogengine.Net
Affected Vendors
References (6)
Mailing List
http://seclists.org/fulldisclosure/2019/Jun/26
Mailing List
http://seclists.org/fulldisclosure/2019/Jun/26
45
/ 100
moderate-risk
Severity
30/34 · Critical
Exploitability
10/34 · Low
Exposure
5/34 · Minimal