CVE-2022-21829

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.

• CWE-319
• CWE-319

• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C
• https://hackerone.com/reports/1482520%2C
• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C
• https://hackerone.com/reports/1482520%2C

Published

Jun 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21823A insecure storage of sensitive information vulnerability ex…5.5
• CVE-2022-21824Due to the formatting logic of the "console.table()" functio…8.2
• CVE-2022-21825An Improper Access Control vulnerability exists in Citrix Wo…7.8
• CVE-2022-21826Pulse Secure version 9.115 and below may be susceptible to c…5.4
• CVE-2022-21827An improper privilege vulnerability has been discovered in C…7.1
• CVE-2022-21828A user with high privilege access to the Incapptic Connect w…7.2
• CVE-2022-2183Out-of-bounds Read in GitHub repository vim/vim prior to 8.2…7.8
• CVE-2022-21830A blind self XSS vulnerability exists in RocketChat LiveChat…6.1
• CVE-2022-21831A code injection vulnerability exists in the Active Storage …9.8
• CVE-2022-21833Virtual Machine IDE Drive Elevation of Privilege Vulnerabili…7.8
• CVE-2022-21834Windows User-mode Driver Framework Reflector Driver Elevatio…7.8
• CVE-2022-21835Microsoft Cryptographic Services Elevation of Privilege Vuln…7.8