CVE-2022-43690 In CMS below 8.5.10, the legacy_salt function was not compared strictly, allowing authentication bypass if used.

CVE-2022-43690 In CMS below 8.5.10, the legacy_salt function was not compared strictly, allowing authentication bypass if used.

If you are running a version before 9.1.3, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin. If you are on 9.1.3, upgrade immediately. If you are on 8.5.10, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin. If you are on a version before 9.1.3, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin. A possible authentication bypass was discovered where the legacy_salt in concrete5 could be used to bypass authentication. This has been fixed in concrete5 9.1.3+ and 8.5.10+. If you are on a previous version, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin.

Summary

A possible authentication bypass was discovered where the legacy_salt in concrete5 could be used to bypass authentication. This has been fixed in concrete5 9.1.3+ and 8.5.10+. If you are on a previous version, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin.

What you need to know about concrete5 authentication bypass vulnerability

Version 9.1.3+ and 8.5.10+ are the only versions that currently have this vulnerability fixed. If you are on a version before 9.1.3, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5.

How to protect yourself from this vulnerability

If you are running a version before 9.1.3, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin. If you are on 9.1.3, upgrade immediately. If you are on 8.5.10, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin. If you are on a version before 9.1.3, update as soon as possible. We do not yet know if this vulnerability affects other versions of concrete5. Stay updated on the concrete5 security bulletin
A successful attack can be launched against your application without any user interaction or administrator action required to exploit it

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe