Medium severity · published May 22, 2024
CVE-2024-30420
Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
a-blog cms Ver.3.0.x series · appleple inc.
prior to Ver.3.0.32 · source: vendor
AC
a-blog cms Ver.3.1.x series · appleple inc.
prior to Ver.3.1.12 · source: vendor
AC
A-blog Cms · Appleple
3.0.0 before 3.0.32; 3.1.0 before 3.1.12 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-30420
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-30420
Vendor Advisory
https://developer.a-blogcms.jp/blog/news/JVN-70977403.html
Third Party Advisory
https://jvn.jp/en/jp/JVN70977403/
More from a-blog cms Ver.3.0.x series
8.8
CVE-2024-23348
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior…
8.8
CVE-2024-23180
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior…
8.1
CVE-2024-23182
Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior…
7.5
CVE-2025-31103
Untrusted data deserialization vulnerability exists in a-blog cms
6.6
CVE-2024-31396
Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32