PT-2019-12008 · Microsoft · Blogengine.Net

Aaron Bishop · Publicado 2019-06-21 · Atualizado 2019-06-23 · CVE-2019-10718

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlogEngine.NET versions 3.3.7.0 and earlier

Description The issue is related to XML External Entity Blind Injection. It is associated with the pingback.axd endpoint and the BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs file.

Recommendations For BlogEngine.NET versions 3.3.7.0 and earlier, consider disabling the pingback.axd endpoint until a patch is available. Restrict access to the BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs file to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-10718

Produtos afetados

Blogengine.Net

Referências · 4

• 🔥 http://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html · Exploit
• 🔥 https://securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks · Exploit
• https://osv.dev/vulnerability/CVE-2019-10718 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10718 · Nota de Segurança