GHSA-2237-5r9w-vm8j
Connect-CMS information that is restricted to viewing is visible
8.7 HighFix available
Impact
- Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0).
- Impact by version
- v1.8.0 ~ v1.8.3: It will be displayed in the text.
- v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link.
- Target viewing restriction function
- Frame publishing function (private, limited publishing)
- IP Restriction Page
- Password setting page
- Impact by version
Patches (fixed version)
- Apply v1.8.4.
Workarounds
- Remove the site search (e.g. hide frames).。
References
none
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Connect-CMS information that is restricted to viewing is visible
Impact
- Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0).
- Impact by version
- v1.8.0 ~ v1.8.3: It will be displayed in the text.
- v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link.
- Target viewing restriction function
- Frame publishing function (private, limited publishing)
- IP Restriction Page
- Password setting page
- Impact by version
Patches (fixed version)
- Apply v1.8.4.
Workarounds
- Remove the site search (e.g. hide frames).。
References
none
- Record
GHSA-2237-5r9w-vm8j- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Connect-CMS information that is restricted to viewing is visible
Impact
- Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0).
- Impact by version
- v1.8.0 ~ v1.8.3: It will be displayed in the text.
- v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link.
- Target viewing restriction function
- Frame publishing function (private, limited publishing)
- IP Restriction Page
- Password setting page
- Impact by version
Patches (fixed version)
- Apply v1.8.4.
Workarounds
- Remove the site search (e.g. hide frames).。
References
none
- Record
GHSA-2237-5r9w-vm8j- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensource-workshop/connect-cmsPackagist | through 1.8.3 | 1.8.4 |
opensource-workshop/connect-cmsPackagist | before 1.8.4, plus listed versions v0.0.1.20200106v0.0.1.20200216v0.0.1.20200302v0.0.1.20200411v0.0.1.20200510 Show 45 moreShow lessv0.0.1.20200603v0.0.1.20200716v0.0.1.20200909v0.0.1.20201008v0.0.1.20201207v0.0.1.20210104v0.0.1.20210301v0.0.1.20210405v0.0.1.20211130v0.0.1.20220207v1.0.0v1.1.0v1.1.1v1.1.2v1.1.3v1.2.0v1.2.1v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.3.0v1.3.1v1.3.2v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4v1.5.0v1.5.1v1.5.2v1.5.3v1.6.0v1.6.1v1.6.2v1.7.0v1.7.1v1.7.2v1.8.0v1.8.1v1.8.2 | 1.8.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2237-5r9w-vm8j is a high vulnerability (CVSS 8.7) in opensource-workshop/connect-cms, published February 7, 2025. No source lists public exploit code. Fixed in opensource-workshop/connect-cms 1.8.4.
References
This page doesn't list everything
Left out here: 1 version. The JSON record has them.