CVE-2025-2304 — Camaleon CMS Privilege Escalation
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. T…
Published: 2025-03-14 · CVSS: 9.4 · CVSS 4.0
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7