GHSA-2237-5r9w-vm8j: Infoleak
First published: Fri Feb 07 2025(Updated: )
### Impact - Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0). - Impact by version - v1.8.0 ~ v1.8.3: It will be displayed in the text. - v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link. - Target viewing restriction function - Frame publishing function (private, limited publishing) - IP Restriction Page - Password setting page ### Patches (fixed version) - Apply v1.8.4. ### Workarounds - Remove the site search (e.g. hide frames).。 ### References none
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/opensource-workshop/connect-cms | <=1.8.3 | 1.8.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the impact of GHSA-2237-5r9w-vm8j?
Sensitive information that should be restricted can be displayed in the main text of the site search results between versions 1.8.0 and 1.8.3.
Which versions are affected by GHSA-2237-5r9w-vm8j?
Versions 1.8.0 to 1.8.3 of the open-source workshop connect-cms are affected by this vulnerability.
How do I fix GHSA-2237-5r9w-vm8j?
Upgrade to version 1.8.4 of the connect-cms package to resolve this vulnerability.
What software is vulnerable in GHSA-2237-5r9w-vm8j?
The open-source workshop connect-cms versions 1.8.0 through 1.8.3 are vulnerable.
Is there a workaround for GHSA-2237-5r9w-vm8j?
No specific workarounds are provided, the recommended action is to upgrade to a non-vulnerable version.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2237-5r9w-vm8j
- agent/software-canonical-lookup
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/type
- agent/event
- agent/tags
- collector/github-advisory
- package-manager/composer