CVE-2024-23348

2024-01-2309:39:14

jpcert

www.cve.org

input validation vulnerability

a-blog cms

remote attack

arbitrary code execution

svg file.

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.9%

JSON

Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a specially crafted SVG file.

CNA Affected

[
  {
    "vendor": "appleple inc.",
    "product": "a-blog cms Ver.3.1.x series",
    "versions": [
      {
        "version": "prior to Ver.3.1.7",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "appleple inc.",
    "product": "a-blog cms Ver.3.0.x series",
    "versions": [
      {
        "version": "prior to Ver.3.0.29",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "appleple inc.",
    "product": "a-blog cms Ver.2.11.x series",
    "versions": [
      {
        "version": "prior to Ver.2.11.58",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "appleple inc.",
    "product": "a-blog cms Ver.2.10.x series",
    "versions": [
      {
        "version": "prior to Ver.2.10.50",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "appleple inc.",
    "product": "a-blog cms",
    "versions": [
      {
        "version": "Ver.2.9.0 and earlier ",
        "status": "affected"
      }
    ]
  }
]