{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-30420", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-03-27T03:59:36.078Z", "datePublished": "2024-05-22T04:35:26.240Z", "dateUpdated": "2024-08-19T19:36:17.408Z"}, "containers": {"cna": {"affected": [{"vendor": "appleple inc.", "product": "a-blog cms Ver.3.1.x series", "versions": [{"version": "prior to Ver.3.1.12", "status": "affected"}]}, {"vendor": "appleple inc.", "product": "a-blog cms Ver.3.0.x series", "versions": [{"version": "prior to Ver.3.0.32", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public."}], "problemTypes": [{"descriptions": [{"description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"}, {"url": "https://jvn.jp/en/jp/JVN70977403/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-05-22T04:35:26.240Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:07.390Z"}, "title": "CVE Program Container", "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN70977403/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "affected": [{"vendor": "appleple", "product": "a-blog_cms", "cpes": ["cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.1.12", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "3.0.32", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-19T19:22:17.028297Z", "id": "CVE-2024-30420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T19:36:17.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN70977403/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:07.390Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-30420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-19T19:22:17.028297Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*"], "vendor": "appleple", "product": "a-blog_cms", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.12", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.0.32", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T19:27:27.955Z"}}], "cna": {"affected": [{"vendor": "appleple inc.", "product": "a-blog cms Ver.3.1.x series", "versions": [{"status": "affected", "version": "prior to Ver.3.1.12"}]}, {"vendor": "appleple inc.", "product": "a-blog cms Ver.3.0.x series", "versions": [{"status": "affected", "version": "prior to Ver.3.0.32"}]}], "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"}, {"url": "https://jvn.jp/en/jp/JVN70977403/"}], "descriptions": [{"lang": "en", "value": "Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-05-22T04:35:26.240Z"}}}, "cveMetadata": {"cveId": "CVE-2024-30420", "state": "PUBLISHED", "dateUpdated": "2024-08-19T19:36:17.408Z", "dateReserved": "2024-03-27T03:59:36.078Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-05-22T04:35:26.240Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5CDA3C7-736D-4E64-B2E0-7C45C702DF32", "versionEndExcluding": "3.0.32", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "358CC9AE-9361-45BA-B28D-1AE64536FA46", "versionEndExcluding": "3.1.12", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public."}, {"lang": "es", "value": "La vulnerabilidad de Server-Side Request Forgery (SSRF) existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.12 y en las versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.32. Si se explota esta vulnerabilidad, un usuario con privilegios de administrador o superiores que pueda iniciar sesi\u00f3n en el producto puede obtener archivos arbitrarios en el servidor e informaci\u00f3n en el servidor interno que no se divulga al p\u00fablico."}], "id": "CVE-2024-30420", "lastModified": "2025-05-12T14:23:35.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-22T05:15:52.983", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN70977403/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN70977403/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}