CVE-2024-30420 Server-side request forgery in a-blog cms Ver.3.0.x series
Administrators can exploit SSRF to read arbitrary server files and internal information in a-blog cms.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30420?
CVE-2024-30420 is a medium-severity server-side request forgery vulnerability in appleple inc. a-blog cms Ver.3.0.x series, published on 22 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.
Weakness: CWE-918
Which versions are affected by CVE-2024-30420?
It affects 1 product.
Products include Appleple A-Blog Cms.
How do I fix CVE-2024-30420?
No fix has been published for CVE-2024-30420 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-30420 being exploited?
There is no known exploitation of CVE-2024-30420 in the wild and no public exploit code.
Other vulnerabilities in appleple inc. a-blog cms Ver.3.0.x series
Sources
Also known as GHSA-5p7q-vjp4-vcrg.