developer.a-blogcms.jp
https://developer.a-blogcms.jp/blog/news/JVN-34565930.html CVE-2024-23348
HIGH
Record summary
CVE-2024-23348 has a selected CVSS score of 8.8 (high).
Description
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a specially crafted SVG file.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated May 8, 2025 · Source: CVE List
Affected products and versions
5| Product | Source | Version range | Status |
|---|---|---|---|
a-blog cmsBrowse appleple inc. / a-blog cms | CVE List | Ver.2.9.0 and earlier | affected |
a-blog cms Ver.2.10.x seriesBrowse appleple inc. / a-blog cms Ver.2.10.x series | CVE List | prior to Ver.2.10.50 | affected |
a-blog cms Ver.2.11.x seriesBrowse appleple inc. / a-blog cms Ver.2.11.x series | CVE List | prior to Ver.2.11.58 | affected |
a-blog cms Ver.3.0.x seriesBrowse appleple inc. / a-blog cms Ver.3.0.x series | CVE List | prior to Ver.3.0.29 | affected |
a-blog cms Ver.3.1.x seriesBrowse appleple inc. / a-blog cms Ver.3.1.x series | CVE List | prior to Ver.3.1.7 | affected |
References
3jvn.jp
https://jvn.jp/en/jp/JVN34565930 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-23348