Description
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2022-21540 Vulnerability (CVE-2022-21540)
Grafana Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-27962)
WordPress Plugin Custom Field Suite Cross-Site Request Forgery (2.5.15)
MySQL CVE-2012-3173 Vulnerability (CVE-2012-3173)
Grafana Missing Authentication for Critical Function Vulnerability (CVE-2022-28660)