CVE-2022-25591
Published: 13 May 2022
Summary
CVE-2022-25591 is a critical-severity Path Traversal (CWE-22) vulnerability in Blogengine Blogengine.Net. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
BlogEngine.NET version 3.3.8.0 contains an arbitrary file deletion vulnerability tracked as CVE-2022-25591 and assigned CWE-22. The flaw permits deletion of arbitrary files inside the web server root directory when a crafted HTTP request is processed, carrying a CVSS 3.1 score of 9.1 that reflects network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can send a specially formed request to trigger the deletion, resulting in loss of integrity and availability for files under the application root without affecting confidentiality. The supplied references point to the vendor site and a technical advisory describing the issue, but contain no explicit statements on patches or configuration changes that would mitigate the flaw. The associated EPSS score has remained flat at 0.0974 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30252
Vulnerability details
BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.