Every CVE Search/ Get API key

CVE-2025-2304

Camaleon CMS Privilege Escalation

9.4 CriticalPublic exploitFix available

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.63%Up 0.6 points since Mar 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.4

Camaleon CMS Privilege Escalation

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Record
CVE-2025-2304
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-915
Updated
2026-11-02
EUVDEUVD-2025-6434 9.4

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Record
EUVD-2025-6434
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rp28-mvq3-wf8j 9.4

Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Record
GHSA-rp28-mvq3-wf8j
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-915
Updated
2026-11-02
NVD 9.4

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Record
CVE-2025-2304
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-915
Updated
2026-11-02
OSVGHSA-rp28-mvq3-wf8j 9.4

Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

Record
GHSA-rp28-mvq3-wf8j
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-915
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
camaleon_cms
RubyGems
 before 2.9.1
2.9.1
camaleon_cms
RubyGems
 before 2.9.1, plus listed versions
0.0.10.0.20.1.20.1.30.1.4
Show 45 moreShow less
0.1.50.1.60.1.70.1.80.1.90.2.00.2.11.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.02.0.12.0.22.0.32.0.42.0.4.12.1.02.1.12.1.1.42.1.2.02.1.2.12.2.02.2.12.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.7.12.3.7.22.4.02.4.12.4.22.4.32.4.3.1
2.9.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0xk4rth1/CVE-2025-23042026-06-19
PoC in GitHub7acini/CVE-2025-2304-CamaleonCMS-PoC2026-02-01
PoC in GitHubAlien0ne/CVE-2025-23042026-02-04
PoC in GitHubAzureADTrent/CVE-2025-2304_POC2026-02-01
PoC in GitHubCsuriBird/CVE-2025-23042026-02-06
PoC in GitHubJeanback1/CVE-2025-2304-exploit2026-04-24
PoC in GitHubPwnManjaro/CVE-2025-23042026-02-04
PoC in GitHubaskiesec/CVE-2025-2304-POC2026-06-06
PoC in GitHubd3vn0mi/CVE-2025-2304-POC2026-01-31
PoC in GitHubestebanzarate/CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC2026-02-20
Show 8 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubinnocentx0/CVE-2025-2304-POC2026-01-31
PoC in GitHubkarimelsheikh1/HTB-Facts-Writeup2026-04-24
PoC in GitHublil0xplorer/CVE-2025-2304-PoC2026-02-01
PoC in GitHubmattiapertusati/htb-facts2026-04-19
PoC in GitHubpredyy/CVE-2025-23042026-02-01
PoC in GitHubsparrowhawk1113/Exploit-for-CVE-2025-23042026-02-05
PoC in GitHubthe8frust/CVE-2025-23042026-02-01
PoC in GitHubwhiteov3rflow/CVE-2025-2304-POC2026-01-31

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-2304 is a critical vulnerability (CVSS 9.4) in Owen2345 Camaleon-cms, published March 14, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in camaleon_cms 2.9.1.

References

This page doesn't list everything

Left out here: 66 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open