Vulnerability · Published Mar 12, 2024 · Assigned by jpcert
CVE-2024-27279
Medium 6.5
In plain English
A medium-severity path traversal in a-blog cms from appleple inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with editor or higher privilege who can login to the product may obtain arbitrary files on the server including password files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| appleple inc. | a-blog cms Ver.3.1.x series | Ver.3.1.9 and earlier |
| appleple inc. | a-blog cms Ver.3.0.x series | Ver.3.0.30 and earlier |
| appleple inc. | a-blog cms Ver.2.11.x series | Ver.2.11.59 and earlier |
| appleple inc. | a-blog cms Ver.2.10.x series | Ver.2.10.51 and earlier |
| appleple inc. | a-blog cms | Ver.2.9 and earlier |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N