{"id":"CVE-2019-10719","published":"2019-06-21T18:11:57Z","modified":"2024-08-04T22:32:00Z","title":"BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is…","vendor":null,"product":null,"tier":"tail","description":{"text":"BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07458,"percentile":0.94441,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2019/Jun/26","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720","tags":["x_refsource_MISC"]}],"priority":{"score":23.9,"factors":[{"name":"EPSS percentile","points":18.89},{"name":"Public exploit code","points":5.0}]},"euvd":{"id":"EUVD-2019-2513","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html"],"lineage":{"familyId":"fam-cve-2019-6714-family-cve-2019-6714","parents":[{"from":"CVE-2019-6714","to":"CVE-2019-10719","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.","from":"CVE.org","in":"CVE-2019-10719"}]}]}}