PT-2024-20081 · Unknown · A-Blog Cms

Yuta Morioka · Published 2024-01-28 · Updated 2025-06-02 · CVE-2024-23782

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions a-blog cms versions prior to 3.1.7 a-blog cms versions prior to 3.0.29 a-blog cms versions prior to 2.11.58 a-blog cms versions prior to 2.10.50 a-blog cms version 2.9.0 and earlier

Description A cross-site scripting vulnerability exists in a-blog cms. If this vulnerability is exploited, a user with a contributor or higher privilege may execute an arbitrary script on the web browser of the user who accessed the website using the product.

Recommendations For versions prior to 3.1.7, update to version 3.1.7 or later. For versions prior to 3.0.29, update to version 3.0.29 or later. For versions prior to 2.11.58, update to version 2.11.58 or later. For versions prior to 2.10.50, update to version 2.10.50 or later. For version 2.9.0 and earlier, update to a later version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-23782

Affected Products

A-Blog Cms

References · 9

• https://developer.a-blogcms.jp/blog/news/JVN-34565930.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23782 · Security Note
• https://twitter.com/CVEnew/status/1751745964962926653 · Twitter Post
• https://t.me/cvenotify/69815 · Telegram Post
• https://t.me/cvenotify/124396 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1751779734814347358 · Twitter Post
• https://t.me/cvenotify/69021 · Telegram Post
• https://jvn.jp/en/jp/JVN34565930 · Note