What’s Vulnerable › Vulnerabilities

CVE-2022-21142

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-24 · updated 2026-06-17
• Weakness: CWE-290

Description

Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x series versions prior to Ver.2.10.43, and Ver.2.11.x series versions prior to Ver.2.11.41 allows a remote unauthenticated attacker to bypass authentication under the specific condition.

Affected products

• appleple inc. a-blog cms: from 2.8.0 before 2.8.74; from 2.9.0 before 2.9.39; from 2.10.0 before 2.10.43; from 2.11.0 before 2.11.41 — fixed in 2.10.43, 2.11.41, 2.8.74, 2.9.39

How to fix

Upgrade to a fixed version: appleple inc. a-blog cms 2.10.43, 2.11.41, 2.8.74, 2.9.39. Check the vendor advisory for mitigations.

References

• https://developer.a-blogcms.jp/blog/news/security-202202.html
• https://jvn.jp/en/jp/JVN14706307/index.html
• https://developer.a-blogcms.jp/blog/news/security-202202.html
• https://jvn.jp/en/jp/JVN14706307/index.html

Get alerted when CVE-2022-21142 or the next vulnerability affects your stack