CVE-2024-27279

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with editor or higher privilege who can login to the product may obtain arbitrary files on the server including password files.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://developer.a-blogcms.jp/blog/news/JVN-48443978.html	Vendor Advisory
https://jvn.jp/en/jp/JVN48443978/	Third Party Advisory
https://developer.a-blogcms.jp/blog/news/JVN-48443978.html	Vendor Advisory
https://jvn.jp/en/jp/JVN48443978/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:appleple:a-blog_cms::::::::
	cpe:2.3:a:appleple:a-blog_cms::::::::
	cpe:2.3:a:appleple:a-blog_cms::::::::
	cpe:2.3:a:appleple:a-blog_cms::::::::

History

13 May 2025, 15:13

Type	Values Removed	Values Added
CPE		cpe:2.3:a:appleple:a-blog_cms::::::::
References	~~() https://developer.a-blogcms.jp/blog/news/JVN-48443978.html -~~	() https://developer.a-blogcms.jp/blog/news/JVN-48443978.html - Vendor Advisory
References	~~() https://jvn.jp/en/jp/JVN48443978/ -~~	() https://jvn.jp/en/jp/JVN48443978/ - Third Party Advisory
First Time		Appleple Appleple a-blog Cms

Information

Published : 2024-03-12 09:15

Updated : 2025-05-13 15:13

NVD link : CVE-2024-27279

Mitre link : CVE-2024-27279

CVE.ORG link : CVE-2024-27279

JSON object : View

Products Affected

appleple

a-blog_cms

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-27279", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-03-12T09:15:10.070", "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-48443978.html", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN48443978/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://developer.a-blogcms.jp/blog/news/JVN-48443978.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://jvn.jp/en/jp/JVN48443978/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with editor or higher privilege who can login to the product may obtain arbitrary files on the server including password files."}, {"lang": "es", "value": "Existe una vulnerabilidad de Directory traversal en a-blog cms Serie Ver.3.1.x Ver.3.1.9 y anteriores, Serie Ver.3.0.x Ver.3.0.30 y anteriores, Serie Ver.2.11.x Ver.2.11.59 y anteriores, Serie Ver.2.10.x Ver.2.10.51 y anteriores, y Ver.2.9 y versiones anteriores. Si se explota esta vulnerabilidad, un usuario con privilegios de editor o superiores que pueda iniciar sesi\u00f3n en el producto puede obtener archivos arbitrarios en el servidor, incluidos archivos de contrase\u00f1as."}], "lastModified": "2025-05-13T15:13:51.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78FD364E-37B6-47A4-93E3-64196D5484B1", "versionEndIncluding": "2.10.51"}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34273351-2450-40F2-B9E9-454C46B6271F", "versionEndIncluding": "2.11.59", "versionStartIncluding": "2.11.0"}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7864AE5E-5964-4583-AA42-271352F5E4DA", "versionEndIncluding": "3.0.30", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF2DC06A-9858-41F5-9E2C-08D85C95101C", "versionEndIncluding": "3.1.9", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}