Input Validation Vulnerability in a-blog CMS Affecting Multiple Versions
CVE-2024-23348

8.8HIGH

Key Information:

Vendor: Appleple Inc.
Status: A-blog Cms Ver.3.1.x Series; A-blog Cms Ver.3.0.x Series; A-blog Cms Ver.2.11.x Series; A-blog Cms Ver.2.10.x Series
Vendor: CVE Published:; 23 January 2024

🔔 Create Appleple Inc. Vulnerability Alert

What is CVE-2024-23348?

This vulnerability arises from improper input validation within the a-blog CMS product, which impacts several versions across different series. Attackers with authenticated access can exploit this flaw by uploading specially crafted SVG files, leading to the execution of arbitrary JavaScript code. Such capability poses significant security risks, enabling a range of malicious activities that could compromise the integrity and security of affected web applications.

Affected Version(s)

a-blog cms Ver.2.9.0 and earlier

a-blog cms Ver.2.10.x series prior to Ver.2.10.50

a-blog cms Ver.2.11.x series prior to Ver.2.11.58

References

https://developer.a-blogcms.jp/blog/news/JVN-34565930.html

https://jvn.jp/en/jp/JVN34565930/

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 23, 2024
Vulnerability Reserved
Jan 15, 2024

CVE-2024-23348 Data

JSON