Description (CNA)
Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| appleple inc. / a-blog cms (Ver.3.1.x series) | affected prior to Ver.3.1.37 |
| appleple inc. / a-blog cms (Ver.3.0.x series) | affected prior to Ver.3.0.41 |
| appleple inc. / a-blog cms (Ver.2.11.x series) | affected prior to Ver.2.11.70 |
| appleple inc. / a-blog cms (Ver.2.10.x series) | affected prior to Ver.2.10.58 |
| appleple inc. / a-blog cms (Ver.2.9.x series) | affected prior to Ver.2.9.46 |
| appleple inc. / a-blog cms (Ver. 2.8.x series) | affected prior to Ver.2.8.80 |
CWE
CWE-502
References
- https://developer.a-blogcms.jp/blog/news/security-update202503.html
- https://developer.a-blogcms.jp/blog/news/entry-4197.html
- https://jvn.jp/en/jp/JVN66982699/
ADP enrichment
No English description supplied.
No references supplied.