The listed vulnerability in Bludit CMS 3.22.0 enables a remote attacker to retrieve sensitive data by accessing the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. The flaw allows disclosure of confidential information that is intended to be protected by the admin interface, thereby compromising the confidentiality of the site. This weakness falls under the category of unauthorized information exposure and may lead to further exploitation if sensitive configuration details or user data are exposed.

Bludit Content Management System version 3.22.0 is impacted. No other vendors or versions are identified in the current CNA data.

The CVSS score is 4.9, and the EPSS score is unavailable, making the exploitation likelihood uncertain. Because the vulnerability is accessed over the network via specific AJAX endpoints, an attacker must reach the web application externally. The issue is not listed in the CISA KEV catalog, indicating no publicly known exploits. Nonetheless, the potential for information leakage makes this a priority concern for any active installation of Bludit 3.22.0.