| Package | Affected versions | Patched versions |
|---|---|---|
| opensource-workshop/connect-cms | ≥ 2.0.0, < 2.41.1< 1.41.1 | 2.41.11.41.1 |
| connect-cms | ≥ 1.0.0, < 1.41.1≥ 2.0.0, < 2.41.1 | 1.41.12.41.1 |
An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information.
In part of the page content retrieval feature, insufficient authorization checks could allow processing associated with non-public pages to be executed. If exploited, the contents and attachments of non-public pages may be obtained by a third party. Users affected by this vulnerability should update to a fixed version.
Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later.
OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free