Cross-Site Scripting Vulnerability in a-blog cms by a-blog cms
CVE-2024-23782

5.4MEDIUM

Key Information:

Vendor: Appleple Inc.
Status: A-blog Cms Ver.3.1.x Series; A-blog Cms Ver.3.0.x Series; A-blog Cms Ver.2.11.x Series; A-blog Cms Ver.2.10.x Series
Vendor: CVE Published:; 28 January 2024

🔔 Create Appleple Inc. Vulnerability Alert

What is CVE-2024-23782?

A cross-site scripting vulnerability has been identified in multiple versions of a-blog cms, which allows attackers with contributor privileges or higher to execute arbitrary scripts in the web browsers of end users. This vulnerability impacts a range of product versions, necessitating immediate updates to mitigate risks associated with potential exploitation.

Affected Version(s)

a-blog cms Ver.2.9.0 and earlier

a-blog cms Ver.2.10.x series prior to Ver.2.10.50

a-blog cms Ver.2.11.x series prior to Ver.2.11.58

References

https://developer.a-blogcms.jp/blog/news/JVN-34565930.html

https://jvn.jp/en/jp/JVN34565930/

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 28, 2024
Vulnerability Reserved
Jan 22, 2024

CVE-2024-23782 Data

JSON