Vulnerabilities > CVE-2019-10718 - XXE vulnerability in Dotnetblogengine Blogengine.Net

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
dotnetblogengine
CWE-611
NVD
Published: 2019-06-21
Updated: 2019-06-23

Summary

BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.

Vulnerable Configurations

Part Description Count
Application
Dotnetblogengine
8

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/153364/blogengine336337-xxe.txt
idPACKETSTORM:153364
last seen2019-06-22
published2019-06-20
reporterAaron Bishop
sourcehttps://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html
titleBlogEngine.NET 3.3.6 / 3.3.7 XML Injection

References