CVE-2023-22858CWE-552CWE-862

Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

Medium · published March 6, 2023

CVSS v3.1
5.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weaknesses
CWE-552 · Files or Directories Accessible to External Parties; CWE-862 · Missing Authorization
Published
2023-03-06T06:31Z
EPSS history
Timeline
  • 06 MAR 06:31Z
    Stored cross-site scripting in BlogEngine.NET version 3.3.8.0
    cvelistv5