PT-2024-23347 · Unknown · A-Blog Cms

Published 2024-05-22 · Updated 2025-05-12 · CVE-2024-30420

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions a-blog cms versions 3.0.x through 3.0.31 a-blog cms versions 3.1.x through 3.1.11

Description A server-side request forgery (SSRF) issue exists, allowing a user with administrator or higher privilege who can log in to the product to obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.

Recommendations For versions 3.0.x through 3.0.31, update to version 3.0.32 or later. For versions 3.1.x through 3.1.11, update to version 3.1.12 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-30420

Affected Products

A-Blog Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-30420 · Security Note
• https://developer.a-blogcms.jp/blog/news/JVN-70977403.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30420 · Vendor Advisory
• https://t.me/cvenotify/121745 · Telegram Post
• https://jvn.jp/en/jp/JVN70977403 · Note
• https://t.me/cvenotify/80629 · Telegram Post
• https://twitter.com/CVEnew/status/1793284094962618454 · Twitter Post