CVE-2019-6714

State: Published
Severity: Not scored
Published: Mar 17, 2019
Updated: Aug 4, 2024
Reserved: Jan 23, 2019

Description

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.html
46353exploit
https://blogengine.io/
https://github.com/rxtur/BlogEngine.NET/
20190618 BlogEngine.NET Directory traversal + RCEmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.