CVE-2024-27279
published 2024-03-12CVE-2024-27279: Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series…
PriorityP341medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.83%
53.0th percentile
Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with editor or higher privilege who can login to the product may obtain arbitrary files on the server including password files.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| appleple | a-blog_cms | <= 2.10.51 | — |
| appleple | a-blog_cms | 2.11.0 – 2.11.59 | — |
| appleple | a-blog_cms | 3.0.0 – 3.0.30 | — |
| appleple | a-blog_cms | 3.1.0 – 3.1.9 | — |
| appleple_inc | a-blog_cms | — | — |
| appleple_inc | a-blog_cms_ver.2.10.x_series | — | — |
| appleple_inc | a-blog_cms_ver.2.11.x_series | — | — |
| appleple_inc | a-blog_cms_ver.3.0.x_series | — | — |
| appleple_inc | a-blog_cms_ver.3.1.x_series | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-12
Published