Concrete5 Comments on Enumeration Vulnerability

concrete5 is an open source content management system CMS for publishing content on the World Wide Web and intranet. A comment enumeration vulnerability exists in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can exploit this vulnerability by posting a reques...

CVE-2017-18195

An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...