| Package | Affected versions | Patched versions |
|---|---|---|
| concrete cms | < 8.3.0 | 8.3.0 |
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free