PT-2019-9028 · Microsoft · Blogengine.Net

Mustafa Yalassa+-N · Published 2019-05-07 · Updated 2019-05-08 · CVE-2018-14485

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlogEngine.NET version 3.3

Description The issue allows XXE attacks through the POST body to the "metaweblog.axd" endpoint.

Recommendations For BlogEngine.NET version 3.3, consider restricting access to the metaweblog.axd endpoint until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-14485

Affected Products

Blogengine.Net

References · 5

• 🔥 https://exploit-db.com/exploits/46106 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14485 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14485 · Vendor Advisory
• https://github.com/rxtur/BlogEngine.NET/commits/master · Note
• http://packetstormsecurity.com/files/151063/BlogEngine-3.3-XML-External-Entity-Injection.html · Note