CVE-2024-31394

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
appleple inc.	a-blog cms Ver.3.1.x series	prior to Ver.3.1.12
appleple inc.	a-blog cms Ver.3.0.x series	prior to Ver.3.0.32
appleple inc.	a-blog cms Ver.2.11.x series	prior to Ver.2.11.61
appleple inc.	a-blog cms Ver.2.10.x series	prior to Ver.2.10.53
appleple inc.	a-blog cms	Ver.2.9 and earlier

References

https://developer.a-blogcms.jp/blog/news/JVN-70977403.htmlVendor Advisory
https://jvn.jp/en/jp/JVN70977403/Third Party Advisory
https://developer.a-blogcms.jp/blog/news/JVN-70977403.htmlVendor Advisory
https://jvn.jp/en/jp/JVN70977403/Third Party Advisory

Timeline

Published: May 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-313956.1Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ve CVE-2024-313966.6Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3 CVE-2024-313974.9Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in t CVE-2024-313984.3Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user CVE-2024-313996.5Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, pro CVE-2024-31405.4A vulnerability, which was classified as problematic, was found in SourceCodester Computer Laboratory Management System 1.0. This affects an CVE-2024-314006.5Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, uninten CVE-2024-314019.0Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege CVE-2024-314024.3Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared T CVE-2024-314035.4Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data CVE-2024-314044.3Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the CVE-2024-314068.8Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticat