CVE-2017-18195

An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0

published February 26, 2018

CVSS

—

EPSS

11%

Percentile

95.9

In the wild

Unconfirmed

What it is

An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.11051 · 95.9th percentile
Published: 2018-02-26T17:00Z

EPSS history

Timeline

26 FEB 17:00Z
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0
cvelistv5