Connect-CMS information that is restricted to viewing is visible
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
### Impact - Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0). - Impact by version - v1.8.0 ~ v1.8.3: It will be displayed in the text. - v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link. - Target viewing restriction function - Frame publishing function (private, limited publishing) - IP Restriction Page - Password setting page ### Patches (fixed version) - Apply v1.8.4. ### Workarounds - Remove the site search (e.g. hide frames).。 ### References none
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | opensource-workshop/connect-cms (Packagist) | before 1.8.4 | 1.8.4 | Patch available | GHSA-2237-5r9w-vm8j |
- opensource-workshop/connect-cms (Packagist) Vendor— Affected before 1.8.4 Fixed in 1.8.4 Patch available GHSA-2237-5r9w-vm8j
Remediation
- Fix · GHSA-2237-5r9w-vm8j opensource-workshop/connect-cms (Packagist) Fixed in 1.8.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-2237-5r9w-vm8j
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences