PT-2022-25854 · Unknown · Blogengine.Net

Tsungshu Chiu · Published 2022-12-19 · Updated 2023-03-22 · CVE-2022-41418

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlogEngine.NET version 3.3.8.0

Description An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs allows attackers to execute arbitrary code via uploading a crafted PNG file.

Recommendations For BlogEngine.NET version 3.3.8.0, consider disabling the UploadController.cs component until a patch is available to prevent arbitrary code execution. Restrict access to the UploadController.cs to minimize the risk of exploitation. Avoid using the UploadController.cs for uploading files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-41418

Affected Products

Blogengine.Net

References · 8

• https://github.com/BlogEngine/BlogEngine.NET/commit/7f927567db94462ffd37e128c0a53c11c1f81a8d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41418 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41418 · Vendor Advisory
• https://t.me/cvenotify/46593 · Telegram Post
• https://chtsecurity.com/news/8719b7f3-1129-4fb4-8801-298970d81df7 · Note
• https://gist.github.com/tree-chtsec/22a0a531ea188fd5b76fe11d32f41e95 · Note
• https://gist.github.com/tree-chtsec/a02258bb6dea0d16e7e631898c066e05 · Note
• https://t.me/cibsecurity/54915 · Telegram Post