PT-2022-14875 · Unknown · A-Blog Cms

Published 2022-02-24 · Updated 2023-08-08 · CVE-2022-21142

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions a-blog cms versions prior to 2.8.74 a-blog cms versions prior to 2.9.39 a-blog cms versions prior to 2.10.43 a-blog cms versions prior to 2.11.41

Description The issue allows a remote unauthenticated attacker to bypass authentication under specific conditions.

Recommendations For versions prior to 2.8.74, update to version 2.8.74 or later. For versions prior to 2.9.39, update to version 2.9.39 or later. For versions prior to 2.10.43, update to version 2.10.43 or later. For versions prior to 2.11.41, update to version 2.11.41 or later.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2022-21142

Affected Products

A-Blog Cms

References · 4

• https://developer.a-blogcms.jp/blog/news/security-202202.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21142 · Security Note
• https://jvn.jp/en/jp/JVN14706307/index.html · Note