CVE-2024-30420

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-30420
Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html Vendor Advisory
https://jvn.jp/en/jp/JVN70977403/ Third Party Advisory
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html Vendor Advisory
https://jvn.jp/en/jp/JVN70977403/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*
History

12 May 2025, 14:23

Type Values Removed Values Added
First Time Appleple a-blog Cms
Appleple
References () https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - () https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - Vendor Advisory
References () https://jvn.jp/en/jp/JVN70977403/ - () https://jvn.jp/en/jp/JVN70977403/ - Third Party Advisory
CPE cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*

21 Nov 2024, 09:11

Type Values Removed Values Added
References () https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - () https://developer.a-blogcms.jp/blog/news/JVN-70977403.html -
References () https://jvn.jp/en/jp/JVN70977403/ - () https://jvn.jp/en/jp/JVN70977403/ -

19 Aug 2024, 20:35

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de Server-Side Request Forgery (SSRF) existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.12 y en las versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.32. Si se explota esta vulnerabilidad, un usuario con privilegios de administrador o superiores que pueda iniciar sesión en el producto puede obtener archivos arbitrarios en el servidor e información en el servidor interno que no se divulga al público.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.4
CWE CWE-918

22 May 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 05:15

Updated : 2025-05-12 14:23

NVD link : CVE-2024-30420

Mitre link : CVE-2024-30420

CVE.ORG link : CVE-2024-30420

JSON object : View

Products Affected

appleple

  • a-blog_cms
CWE
CWE-918

Server-Side Request Forgery (SSRF)