Camaleon CMS Privilege Escalation Vulnerability

A privilege escalation vulnerability through mass assignment has been identified in Camaleon CMS. This issue arises in the 'updated_ajax' method of the UsersController, where the permit! method is used without proper parameter filtering. As a result, an attacker can exploit this vulnerability by including the role attribute in the request, potentially allowing a user with limited privileges to gain administrative rights.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users with limited rights to gain administrative access.

Remediation

Users are advised to upgrade to Camaleon CMS version 2.9.1 or later.