{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23782", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-01-22T07:59:48.826Z", "datePublished": "2024-01-28T23:09:13.092Z", "dateUpdated": "2024-08-01T23:13:08.244Z"}, "containers": {"cna": {"affected": [{"vendor": "appleple inc.", "product": "a-blog cms Ver.3.1.x series", "versions": [{"version": "prior to Ver.3.1.7", "status": "affected"}]}, {"vendor": "appleple inc.", "product": "a-blog cms Ver.3.0.x series", "versions": [{"version": "prior to Ver.3.0.29", "status": "affected"}]}, {"vendor": "appleple inc.", "product": "a-blog cms Ver.2.11.x series", "versions": [{"version": "prior to Ver.2.11.58", "status": "affected"}]}, {"vendor": "appleple inc.", "product": "a-blog cms Ver.2.10.x series", "versions": [{"version": "prior to Ver.2.10.50", "status": "affected"}]}, {"vendor": "appleple inc.", "product": "a-blog cms", "versions": [{"version": "Ver.2.9.0 and earlier ", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege may execute an arbitrary script on the web browser of the user who accessed the website using the product."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-34565930.html"}, {"url": "https://jvn.jp/en/jp/JVN34565930/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-01-28T23:09:13.092Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:08.244Z"}, "title": "CVE Program Container", "references": [{"url": "https://developer.a-blogcms.jp/blog/news/JVN-34565930.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN34565930/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "733522A6-B4FD-4162-AB01-5BD359E4C808", "versionEndExcluding": "2.10.50", "vulnerable": true}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B9C6A38-B9F3-4B83-872E-4A7FCF10A2CF", "versionEndExcluding": "2.11.58", "versionStartIncluding": "2.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "43352BBA-DDE8-4542-A8E1-10762B634972", "versionEndExcluding": "3.0.29", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:appleple:a-blog_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "E42BDC5D-3F5F-45E4-9135-0AA3E4DA94CE", "versionEndExcluding": "3.1.7", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege may execute an arbitrary script on the web browser of the user who accessed the website using the product."}, {"lang": "es", "value": "La vulnerabilidad de cross site scripting existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.7, versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.29, versiones de la serie Ver.2.11.x anteriores a Ver.2.11.58, versiones de la serie Ver.2.10.x anteriores a Ver.2.10.50 y Ver.2.9.0 y versiones anteriores. Si se explota esta vulnerabilidad, un usuario con un privilegio de colaborador o superior puede ejecutar un script arbitrario en el navegador web del usuario que accedi\u00f3 al sitio web utilizando el producto."}], "id": "CVE-2024-23782", "lastModified": "2024-02-02T15:38:55.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-28T23:15:58.350", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://developer.a-blogcms.jp/blog/news/JVN-34565930.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN34565930/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}