Vulnerability Description
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a specially crafted SVG file.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Appleple | A-Blog Cms | <= 2.9.0 |
References
- https://developer.a-blogcms.jp/blog/news/JVN-34565930.htmlVendor Advisory
- https://jvn.jp/en/jp/JVN34565930/Third Party Advisory
- https://developer.a-blogcms.jp/blog/news/JVN-34565930.htmlVendor Advisory
- https://jvn.jp/en/jp/JVN34565930/Third Party Advisory
FAQ
What is CVE-2024-23348?
CVE-2024-23348 is a vulnerability with a CVSS score of 8.8 (HIGH). Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver....
How severe is CVE-2024-23348?
CVE-2024-23348 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-23348?
Check the references section above for vendor advisories and patch information. Affected products include: Appleple A-Blog Cms.