{"id":"CVE-2019-10720","published":"2019-06-21T18:13:16Z","modified":"2024-08-04T22:32:01Z","title":"BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the…","vendor":null,"product":null,"tier":"tail","description":{"text":"BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07006,"percentile":0.94143,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2019/Jun/26","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/153348/BlogEngine.NET-3.3.6-3.3.7-Theme-Cookie-Directory-Traversal-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720","tags":["x_refsource_MISC"]}],"priority":{"score":23.8,"factors":[{"name":"EPSS percentile","points":18.83},{"name":"Public exploit code","points":5.0}]},"euvd":{"id":"EUVD-2019-2514","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153348/BlogEngine.NET-3.3.6-3.3.7-Theme-Cookie-Directory-Traversal-Remote-Code-Execution.html"],"lineage":{"familyId":"fam-cve-2019-6714-family-cve-2019-6714","parents":[{"from":"CVE-2019-6714","to":"CVE-2019-10720","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.","from":"CVE.org","in":"CVE-2019-10720"}]}]}}