CVE-2024-30420

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-30420
Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
https://jvn.jp/en/jp/JVN70977403/
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
https://jvn.jp/en/jp/JVN70977403/
Configurations

No configuration.

History

21 Nov 2024, 09:11

Type Values Removed Values Added
References () https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - () https://developer.a-blogcms.jp/blog/news/JVN-70977403.html -
References () https://jvn.jp/en/jp/JVN70977403/ - () https://jvn.jp/en/jp/JVN70977403/ -

19 Aug 2024, 20:35

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de Server-Side Request Forgery (SSRF) existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.12 y en las versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.32. Si se explota esta vulnerabilidad, un usuario con privilegios de administrador o superiores que pueda iniciar sesión en el producto puede obtener archivos arbitrarios en el servidor e información en el servidor interno que no se divulga al público.
CWE CWE-918
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.4

22 May 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 05:15

Updated : 2024-11-21 09:11

NVD link : CVE-2024-30420

Mitre link : CVE-2024-30420

CVE.ORG link : CVE-2024-30420

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)