Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2017-18195: Concrete CMS lets anyone list all blog comments
CVE-2017-18195 · published 8 years ago
Summary
The Concrete CMS web platform (versions before 8.3.0) allows anyone on the internet to request comment data from any blog post by sending specially crafted requests. This could expose private conversation content and help attackers map your site’s activity. Upgrade to version 8.3.0 or later, or apply the vendor’s patch, to stop the unauthorized access.
What to do
- Update concretecms concrete_cms to version 8.3.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| concretecms | concrete_cms |
< 8.3.0 cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/re...
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.
References
- https://github.com/concrete5/concrete5/pull/6008/files Patch Third Party Advisory
- https://github.com/concrete5/concrete5/releases/tag/8.3.0 Release Notes Third Party Advisory
- https://github.com/r3naissance/NSE/blob/master/http-vuln-cve2017-18195.nse Exploit Third Party Advisory
- https://www.exploit-db.com/exploits/44194/ Exploit Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published26 Feb 2018
Updated17 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-18195 · NVD
Track software like this
Free during beta