CVE-2025-2304
CVE-2025-2304 · Camaleon CMS Privilege Escalation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
CVSS 9.4 · Critical · EPSS 0.6% · Public exploit
- Published
- Updated
Affected products and versions
camaleon-cms
- Versions
- ≥ 0, < 2.9.1: Not affected (custom)
No fix published