CVE-2024-30420

Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html	Vendor Advisory
https://jvn.jp/en/jp/JVN70977403/	Third Party Advisory
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html	Vendor Advisory
https://jvn.jp/en/jp/JVN70977403/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:appleple:a-blog_cms::::::::
	cpe:2.3:a:appleple:a-blog_cms::::::::

History

12 May 2025, 14:23

Type	Values Removed	Values Added
References	~~() https://developer.a-blogcms.jp/blog/news/JVN-70977403.html -~~	() https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - Vendor Advisory
References	~~() https://jvn.jp/en/jp/JVN70977403/ -~~	() https://jvn.jp/en/jp/JVN70977403/ - Third Party Advisory
CPE		cpe:2.3:a:appleple:a-blog_cms::::::::
First Time		Appleple Appleple a-blog Cms

Information

Published : 2024-05-22 05:15

Updated : 2025-05-12 14:23

NVD link : CVE-2024-30420

Mitre link : CVE-2024-30420

CVE.ORG link : CVE-2024-30420

JSON object : View

Products Affected

appleple

a-blog_cms

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-30420", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "published": "2024-05-22T05:15:52.983", "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN70977403/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://jvn.jp/en/jp/JVN70977403/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public."}, {"lang": "es", "value": "La vulnerabilidad de Server-Side Request Forgery (SSRF) existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.12 y en las versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.32. Si se explota esta vulnerabilidad, un usuario con privilegios de administrador o superiores que pueda iniciar sesi\u00f3n en el producto puede obtener archivos arbitrarios en el servidor e informaci\u00f3n en el servidor interno que no se divulga al p\u00fablico."}], "lastModified": "2025-05-12T14:23:35.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5CDA3C7-736D-4E64-B2E0-7C45C702DF32", "versionEndExcluding": "3.0.32", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "358CC9AE-9361-45BA-B28D-1AE64536FA46", "versionEndExcluding": "3.1.12", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}