PT-2018-6726

Name of the Vulnerable Software and Affected Versions: Concrete5 versions prior to 8.3.0 Description: An issue was discovered in tools/conversations/view ajax.php. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to "/index.php/tools/required/conversations/vi...

CVE-2017-18195: Undefined Security Weakness

An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...