Arbitrary File Access Vulnerability in a-blog cms Prior to Versions 3.1.12, 3.0.32, 2.11.61, 2.10.53, and Earlier
CVE-2024-31394

6.5MEDIUM

Key Information:

Vendor: Appleple Inc.
Status: A-blog Cms Ver.3.1.x Series; A-blog Cms Ver.3.0.x Series; A-blog Cms Ver.2.11.x Series; A-blog Cms Ver.2.10.x Series
Vendor: CVE Published:; 22 May 2024

🔔 Create Appleple Inc. Vulnerability Alert

What is CVE-2024-31394?

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server.

Affected Version(s)

a-blog cms Ver.2.9 and earlier

a-blog cms Ver.2.10.x series prior to Ver.2.10.53

a-blog cms Ver.2.11.x series prior to Ver.2.11.61

References

https://developer.a-blogcms.jp/blog/news/JVN-70977403.html

https://jvn.jp/en/jp/JVN70977403/

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 22, 2024
Vulnerability Reserved
Apr 3, 2024

CVE-2024-31394 Data

JSON