CVE-2023-22858
Published: 06 March 2023
Summary
CVE-2023-22858 is a medium-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Blogengine Blogengine.Net. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26968
Vulnerability details
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Sanitizing equipment before off-site maintenance reduces the risk of files or directories containing sensitive data becoming accessible to external parties.
Enumerating systems surfaces externally reachable resources that would otherwise remain unmonitored and accessible.
Prevents public exposure of files or directories that should not be reachable by unauthenticated parties.
Decoy files and directories detect external access attempts and deflect attackers away from actual accessible resources.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.