{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T17:10:48.613952Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:37:08.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:52:56.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN70977403/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "a-blog cms Ver.3.1.x series",
          "vendor": "appleple inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.3.1.12"
            }
          ]
        },
        {
          "product": "a-blog cms Ver.3.0.x series",
          "vendor": "appleple inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.3.0.32"
            }
          ]
        },
        {
          "product": "a-blog cms Ver.2.11.x series",
          "vendor": "appleple inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.2.11.61"
            }
          ]
        },
        {
          "product": "a-blog cms Ver.2.10.x series",
          "vendor": "appleple inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to Ver.2.10.53"
            }
          ]
        },
        {
          "product": "a-blog cms",
          "vendor": "appleple inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.2.9 and earlier "
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-22T04:35:31.768Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN70977403/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-31394",
    "datePublished": "2024-05-22T04:35:31.768Z",
    "dateReserved": "2024-04-03T02:24:22.988Z",
    "dateUpdated": "2024-08-02T01:52:56.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-31394\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-05-22T05:15:53.053\",\"lastModified\":\"2024-05-22T12:46:53.887\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de Directory traversal existe en las versiones de la serie a-blog cms Ver.3.1.x anteriores a la Ver.3.1.12, versiones de la serie Ver.3.0.x anteriores a la Ver.3.0.32, versiones de la serie Ver.2.11.x anteriores a la Ver. 2.11.61, versiones de la serie Ver.2.10.x anteriores a la Ver.2.10.53 y Ver.2.9 y versiones anteriores. Si se explota esta vulnerabilidad, un usuario con un editor o un privilegio superior que pueda iniciar sesi\u00f3n en el producto puede obtener archivos arbitrarios en el servidor.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://developer.a-blogcms.jp/blog/news/JVN-70977403.html\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/jp/JVN70977403/\",\"source\":\"vultures@jpcert.or.jp\"}]}}"
  }
}