CVE-2023-22858 Stored cross-site scripting in BlogEngine.NET version 3.3.8.0
Unauthenticated attackers can access files from unpublished blogs due to improper access control in BlogEngine.NET.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22858?
CVE-2023-22858 is a medium-severity missing authorization vulnerability in BlogEngine.NET, published on 6 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
Which versions are affected by CVE-2023-22858?
It affects 1 product.
Products include Blogengine Blogengine.net.
How do I fix CVE-2023-22858?
No fix has been published for CVE-2023-22858 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-22858 being exploited?
There is no known exploitation of CVE-2023-22858 in the wild and no public exploit code.
Other vulnerabilities in BlogEngine.NET
Sources
Also known as GHSA-8j76-g3f2-ff7f.