CVE Catalog
CVE-2023-33404
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk22.35%
97th percentile - higher than 97% of all known CVEs
Summary
Version 3.3.8.0 and earlier of BlogEngine.Net contains an Unrestricted Upload vulnerability due to insufficient validation in the UploadControlled.cs file, allowing remote attackers to execute remote code.
Risk Assessment
Attackers can exploit this vulnerability to execute remote code, potentially leading to system takeover and data leakage.
Recommendation
It is recommended to update BlogEngine.Net to the latest version to mitigate this vulnerability and implement additional file upload validation mechanisms.
Original NVD description (English source)
An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.