CVE-2017-18195

State: Published
Severity: Not scored
Published: Feb 26, 2018
Updated: Aug 5, 2024
Reserved: Feb 23, 2018

Description

An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/r3naissance/NSE/blob/master/http-vuln-cve2017-18195.nse
https://github.com/concrete5/concrete5/pull/6008/files
44194exploit
https://github.com/concrete5/concrete5/releases/tag/8.3.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.