CVE-2022-43690

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

• CWE-287

• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notesRelease Notes, Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notesRelease Notes, Vendor Advisory
• https://github.com/concretecms/concretecms/releases/8.5.10Release Notes, Vendor Advisory
• https://github.com/concretecms/concretecms/releases/9.1.3Release Notes, Vendor Advisory
• https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notesRelease Notes, Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notesRelease Notes, Vendor Advisory
• https://github.com/concretecms/concretecms/releases/8.5.10Release Notes, Vendor Advisory
• https://github.com/concretecms/concretecms/releases/9.1.3Release Notes, Vendor Advisory
• https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31Vendor Advisory

Published

Nov 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-43685CKAN through 2.9.6 account takeovers by unauthenticated user…8.8
• CVE-2022-43686In Concrete CMS (formerly concrete5) below 8.5.10 and betwee…6.5
• CVE-2022-43687Concrete CMS (formerly concrete5) below 8.5.10 and between 9…5.4
• CVE-2022-43688Concrete CMS (formerly concrete5) below 8.5.10 and between 9…4.8
• CVE-2022-43689Concrete CMS (formerly concrete5) below 8.5.10 and between 9…5.3
• CVE-2022-4369The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 …6.1
• CVE-2022-43691Concrete CMS (formerly concrete5) below 8.5.10 and between 9…5.3
• CVE-2022-43692Concrete CMS (formerly concrete5) below 8.5.10 and between 9…6.1
• CVE-2022-43693Concrete CMS is vulnerable to CSRF due to the lack of "State…8.8
• CVE-2022-43694Concrete CMS (formerly concrete5) below 8.5.10 and between 9…6.1
• CVE-2022-43695Concrete CMS (formerly concrete5) below 8.5.10 and between 9…4.8
• CVE-2022-43696OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.6.1