VULNERABILITY INTELLIGENCE
CVE-2025-2304
EPSS probability0.63%
CISA KEVNot currently listed
Published2025-03-14
Last modified2026-06-17
Description
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
Weakness classification
- vulnreport@tenable.com: CWE-915