{"id":"CVE-2025-2304","aliases":["EUVD-2025-6434","GHSA-rp28-mvq3-wf8j"],"status":"published","title":"Camaleon CMS Privilege Escalation","description":"A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00628,"percentile":0.50378,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-915"],"published":"2025-03-14T12:34:19Z","modified":"2026-06-17T09:06:43Z","exploits":[{"source":"pocgithub","id":"0xk4rth1/CVE-2025-2304","title":"0xk4rth1/CVE-2025-2304","date":"2026-06-19","url":"https://github.com/0xk4rth1/CVE-2025-2304"},{"source":"pocgithub","id":"7acini/CVE-2025-2304-CamaleonCMS-PoC","title":"7acini/CVE-2025-2304-CamaleonCMS-PoC","date":"2026-02-01","url":"https://github.com/7acini/CVE-2025-2304-CamaleonCMS-PoC"},{"source":"pocgithub","id":"Alien0ne/CVE-2025-2304","title":"Alien0ne/CVE-2025-2304","date":"2026-02-04","url":"https://github.com/Alien0ne/CVE-2025-2304"},{"source":"pocgithub","id":"AzureADTrent/CVE-2025-2304_POC","title":"AzureADTrent/CVE-2025-2304_POC","date":"2026-02-01","url":"https://github.com/AzureADTrent/CVE-2025-2304_POC"},{"source":"pocgithub","id":"CsuriBird/CVE-2025-2304","title":"CsuriBird/CVE-2025-2304","date":"2026-02-06","url":"https://github.com/CsuriBird/CVE-2025-2304"},{"source":"pocgithub","id":"Jeanback1/CVE-2025-2304-exploit","title":"Jeanback1/CVE-2025-2304-exploit","date":"2026-04-24","url":"https://github.com/Jeanback1/CVE-2025-2304-exploit"},{"source":"pocgithub","id":"PwnManjaro/CVE-2025-2304","title":"PwnManjaro/CVE-2025-2304","date":"2026-02-04","url":"https://github.com/PwnManjaro/CVE-2025-2304"},{"source":"pocgithub","id":"askiesec/CVE-2025-2304-POC","title":"askiesec/CVE-2025-2304-POC","date":"2026-06-06","url":"https://github.com/askiesec/CVE-2025-2304-POC"},{"source":"pocgithub","id":"d3vn0mi/CVE-2025-2304-POC","title":"d3vn0mi/CVE-2025-2304-POC","date":"2026-01-31","url":"https://github.com/d3vn0mi/CVE-2025-2304-POC"},{"source":"pocgithub","id":"estebanzarate/CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC","title":"estebanzarate/CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC","date":"2026-02-20","url":"https://github.com/estebanzarate/CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC"},{"source":"pocgithub","id":"innocentx0/CVE-2025-2304-POC","title":"innocentx0/CVE-2025-2304-POC","date":"2026-01-31","url":"https://github.com/innocentx0/CVE-2025-2304-POC"},{"source":"pocgithub","id":"karimelsheikh1/HTB-Facts-Writeup","title":"karimelsheikh1/HTB-Facts-Writeup","date":"2026-04-24","url":"https://github.com/karimelsheikh1/HTB-Facts-Writeup"},{"source":"pocgithub","id":"lil0xplorer/CVE-2025-2304-PoC","title":"lil0xplorer/CVE-2025-2304-PoC","date":"2026-02-01","url":"https://github.com/lil0xplorer/CVE-2025-2304-PoC"},{"source":"pocgithub","id":"mattiapertusati/htb-facts","title":"mattiapertusati/htb-facts","date":"2026-04-19","url":"https://github.com/mattiapertusati/htb-facts"},{"source":"pocgithub","id":"predyy/CVE-2025-2304","title":"predyy/CVE-2025-2304","date":"2026-02-01","url":"https://github.com/predyy/CVE-2025-2304"},{"source":"pocgithub","id":"sparrowhawk1113/Exploit-for-CVE-2025-2304","title":"sparrowhawk1113/Exploit-for-CVE-2025-2304","date":"2026-02-05","url":"https://github.com/sparrowhawk1113/Exploit-for-CVE-2025-2304"},{"source":"pocgithub","id":"the8frust/CVE-2025-2304","title":"the8frust/CVE-2025-2304","date":"2026-02-01","url":"https://github.com/the8frust/CVE-2025-2304"},{"source":"pocgithub","id":"whiteov3rflow/CVE-2025-2304-POC","title":"whiteov3rflow/CVE-2025-2304-POC","date":"2026-01-31","url":"https://github.com/whiteov3rflow/CVE-2025-2304-POC"}],"fixes":[{"ecosystem":"RubyGems","package":"camaleon_cms","fixed_in":["2.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"camaleon_cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"camaleon_cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1"}]}],"versions":["0.0.1","0.0.2","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.4.1","2.1.0","2.1.1","2.1.1.4","2.1.2.0","2.1.2.1","2.2.0","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.7.1","2.3.7.2","2.4.0","2.4.1","2.4.2","2.4.3","2.4.3.1","2.4.3.10","2.4.3.11","2.4.3.12","2.4.3.13","2.4.3.2","2.4.3.3","2.4.3.4","2.4.3.5","2.4.3.6","2.4.3.7","2.4.3.8","2.4.3.9","2.4.4","2.4.4.1","2.4.4.2","2.4.4.3","2.4.4.4","2.4.4.5","2.4.4.6","2.4.4.7","2.4.5","2.4.5.1","2.4.5.10","2.4.5.11","2.4.5.12","2.4.5.13","2.4.5.14","2.4.5.2","2.4.5.3","2.4.5.4","2.4.5.5","2.4.5.7","2.4.5.8","2.4.5.9","2.4.6.0","2.4.6.1","2.4.6.2","2.4.6.3","2.4.6.4","2.4.6.5","2.4.6.6","2.4.6.7","2.4.6.8","2.4.6.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.3.1","2.6.0","2.6.0.1","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.8.0","2.8.1","2.8.2","2.8.3","2.9.0"]}],"products":[{"vendor":"owen2345","product":"camaleon-cms"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2025-09","tags":["web"]},{"url":"https://github.com/owen2345/camaleon-cms","tags":["package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2304","tags":["advisory"]},{"url":"https://github.com/owen2345/camaleon-cms/pull/1109","tags":["web"]},{"url":"https://github.com/owen2345/camaleon-cms/commit/179fd6b1ecf258d3e214aebfa87ac4a322ea4db4","tags":["web"]},{"url":"https://github.com/owen2345/camaleon-cms/releases/tag/2.9.1","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2025-2304.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rp28-mvq3-wf8j"}],"sources":{"cve":[{"id":"CVE-2025-2304","title":"Camaleon CMS Privilege Escalation","description":"A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.","status":"published","published":"2025-03-14T12:34:19.489Z","modified":"2025-03-17T07:45:14.302Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-6434","description":"A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.","status":"published","published":"2025-03-14T12:34:19Z","modified":"2025-03-17T07:45:14Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T20:53:02.264374Z"}],"ghsa":[{"id":"GHSA-rp28-mvq3-wf8j","title":"Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment","description":"A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.","status":"published","published":"2025-03-14T15:32:03Z","modified":"2025-03-19T15:32:06Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:38:35.74197Z"}],"nvd":[{"id":"CVE-2025-2304","description":"A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.","status":"published","published":"2025-03-14T13:15:41.16Z","modified":"2026-06-17T09:06:43.41Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:10:53.93104Z"}],"osv":[{"id":"GHSA-rp28-mvq3-wf8j","title":"Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment","description":"A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.","status":"published","published":"2025-03-14T15:32:03Z","modified":"2025-03-19T15:46:58.677792Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}