CVE-2022-23810

2022-02-2409:50:28

jpcert

www.cve.org

template injection

a-blog cms

cve-2022-23810

file access

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

38.8%

JSON

Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to obtain an arbitrary file on the server via unspecified vectors.

CNA Affected

[
  {
    "product": "a-blog cms",
    "vendor": "appleple inc.",
    "versions": [
      {
        "status": "affected",
        "version": "Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1"
      }
    ]
  }
]