{"action":"Upgrade camaleon_cms to 2.9.1 or later.","affected":[{"fixed":"2.9.1","introduced":"0"}],"component":"camaleon_cms","cve_ids":["CVE-2025-2304"],"ecosystem":"RubyGems","epss":0.00628,"exploited":false,"fixed_versions":["2.9.1"],"ghsa_id":"GHSA-rp28-mvq3-wf8j","id":"tcs_01M5KENABP96AWM1PGG64Y3FF2","modified_at":"2025-03-19T15:46:58.677792Z","published_at":"2025-03-14T15:32:03Z","references":["https://osv.dev/vulnerability/GHSA-rp28-mvq3-wf8j","https://nvd.nist.gov/vuln/detail/CVE-2025-2304","https://github.com/owen2345/camaleon-cms/pull/1109","https://github.com/owen2345/camaleon-cms/commit/179fd6b1ecf258d3e214aebfa87ac4a322ea4db4","https://github.com/owen2345/camaleon-cms","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.1","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2025-2304.yml","https://www.tenable.com/security/research/tra-2025-09"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-rp28-mvq3-wf8j","url":"https://osv.dev/vulnerability/GHSA-rp28-mvq3-wf8j"},{"source":"nvd","source_id":"CVE-2025-2304","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2304"}],"summary":"Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment"}