Description
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.
Remediation
References
Related Vulnerabilities
Oracle Application Server CVE-2008-0340 Vulnerability (CVE-2008-0340)
WordPress Plugin open-flash-chart-core Remote Code Execution (0.4)
WordPress Plugin Advance Menu Manager Security Bypass (3.0)
Jenkins Passwords transmitted in plain text (CVE-2020-2251)
XWikiplatform Incorrect Privilege Assignment Vulnerability (CVE-2025-49580)