CVE-2024-13189 is a high severity (CVSS 7.3) permission flaw in ZeroWdd myblog 1.0, in the MyBlogMvcConfig.java configuration file. The record says it can be started remotely, that the exploit is public, and names no fix. Review access rules around the admin area and check the issue.
What's affected
- ZeroWdd myblog version 1.0.
- The affected file is src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java.
The record names no fixed version, and it describes the exploit as publicly disclosed. Check the project's issue tracker and repository for a patch. If none exists, treat the project as unfixed.
How to check if you're exposed
Run the check below, or read the vendor or project notes linked in Sources.
# Look at your build file for the project and its version
grep -n -i zerowdd pom.xml
Compare the result to the affected range above.
What to do now
- Check whether myblog 1.0 is deployed anywhere you manage.
- Read the linked issue for any maintainer guidance.
- Test which pages of the admin area are reachable without a session, and block them at a reverse proxy while the code is unpatched.
- Consider moving off an unmaintained project if no fix arrives.
- Look up CVE-2024-13189 on its Gold page to see the current details and any fix information.
- Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.
Why it matters
The record says the manipulation leads to permission issues, listed as CWE-266 (incorrect privilege assignment) and CWE-275 (permission issues). The vector shows no privileges and no user interaction needed, with low impact on confidentiality, integrity and availability. The affected file is an MVC configuration class, which in Java web projects is typically where request interceptors and access rules are wired.
The record is thin on specifics, and this post does not guess beyond it. The practical conclusion is that the access control layer in this version cannot be trusted, so exposure should be limited by network controls.
This CVE is a permission and access control flaw (CWE-266, CWE-275, Incorrect Privilege Assignment and Permission Issues). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Access control bugs let someone do something their role should not allow. When the rules live in a central configuration class, a mistake there can affect every route at once.
The safe default is deny. Each route should require an explicit role, and tests should confirm that anonymous requests to admin paths are refused.
Quick check
Is the exploit public?
The record says it has been disclosed to the public.
Why is the score high when the impacts are low?
The vector rates every impact low, but the attack needs no privileges and no interaction, and the score reaches 7.3.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
