critical9.8
CVE-2019-12277
Blogifier does not properly restrict APIs
Impact
Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for `..` in a pathname. The issue is patched in the `2.4` branch, but `2.5.5` is the lowest available patched version on https://www.nuget.org/packages/Blogifier.Core.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Blogifier.Core | < 2.4 | 2.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Blogifier | Blogifier | Version 2.3 |