Improper Input Validation in a-blog CMS Affecting Multiple Versions by a-blog
CVE-2024-23180

8.8HIGH

Key Information:

Vendor

Appleple Inc.

Status
A-blog Cms Ver.3.1.x Series
A-blog Cms Ver.3.0.x Series
A-blog Cms Ver.2.11.x Series
A-blog Cms Ver.2.10.x Series
Vendor
CVE Published:
23 January 2024

What is CVE-2024-23180?

An improper input validation vulnerability exists in the a-blog CMS that affects various versions, enabling remote authenticated attackers to execute arbitrary code via the upload of a specially crafted SVG file. This flaw poses a significant security risk to users of the CMS, as successful exploitation could lead to unauthorized actions on the affected systems, potentially compromising sensitive data or altering website functionality.

Affected Version(s)

a-blog cms Ver.2.9.0 and earlier

a-blog cms Ver.2.10.x series prior to Ver.2.10.50

a-blog cms Ver.2.11.x series prior to Ver.2.11.58

References

https://developer.a-blogcms.jp/blog/news/JVN-34565930.html
https://jvn.jp/en/jp/JVN34565930/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.