« Volver al listado

CVE-2024-30420

Estado: AnalizadaMedia (4.4)—

Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Appleple — A-blog CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-30420",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-30420",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-19T19:22:17.028297Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "appleple inc.",
          "product": "a-blog cms Ver.3.1.x series",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.3.1.12"
            }
          ]
        },
        {
          "vendor": "appleple inc.",
          "product": "a-blog cms Ver.3.0.x series",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.3.0.32"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*"
          ],
          "vendor": "appleple",
          "product": "a-blog_cms",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.1.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.0.32",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-22T05:15:52.983",
  "references": [
    {
      "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN70977403/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN70977403/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Server-Side Request Forgery (SSRF) existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.12 y en las versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.32. Si se explota esta vulnerabilidad, un usuario con privilegios de administrador o superiores que pueda iniciar sesión en el producto puede obtener archivos arbitrarios en el servidor e información en el servidor interno que no se divulga al público."
    }
  ],
  "lastModified": "2026-06-17T07:26:56.267",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5CDA3C7-736D-4E64-B2E0-7C45C702DF32",
              "versionEndExcluding": "3.0.32",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "358CC9AE-9361-45BA-B28D-1AE64536FA46",
              "versionEndExcluding": "3.1.12",
              "versionStartIncluding": "3.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}