Access Control Vulnerability in Connect-CMS: A Security Concern
Summary
GHSA-5rjc-jc28-cwgg: Connect-CMS Access control vulnerability. Affects opensource-workshop/connect-cms across 2 version ranges.
< 1.8.7
>= 2.0.0, < 2.4.7
Fixed in 1.8.7 or 2.4.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Connect-CMS is an open-source content management system designed to facilitate the creation and management of digital content. It offers features such as user management, content publishing, and customizable templates, making it a popular choice among developers and organizations. However, certain versions of Connect-CMS are susceptible to an access control vulnerability that could potentially allow unauthorized access to sensitive management functionalities.
Vulnerability Detail
The vulnerability in Connect-CMS arises from inadequate access control mechanisms within its management system. This flaw allows unauthorized users to gain access to restricted areas, potentially leading to data exposure or manipulation. The affected versions include Connect-CMS v1.8.6, 2.4.6, and earlier. The vulnerability is classified under CWE-284, indicating a failure to enforce proper access controls, which can have moderate severity implications for users and administrators.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.71.8.7composer require opensource-workshop/connect-cms:1.8.7 -
>= 2.0.0, < 2.4.72.4.7composer require opensource-workshop/connect-cms:2.4.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users are advised to restrict access to the management system by implementing additional authentication layers or IP whitelisting until the upgrade can be performed.
Conclusion
The access control vulnerability in Connect-CMS poses a significant risk to users and administrators by potentially allowing unauthorized access to sensitive management functionalities. It is crucial to upgrade to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can be employed until the upgrade is completed.
See every vulnerability recorded for opensource-workshop/connect-cms →
FAQ
The vulnerability is an access control issue that allows unauthorized users to access restricted areas of the Connect-CMS management system.
The affected versions include Connect-CMS v1.8.6, 2.4.6, and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If an immediate upgrade is not possible, consider implementing additional security measures such as restricting access to the management system through authentication layers or IP whitelisting.
References
Related vulnerabilities
Recent vulnerabilities recorded for opensource-workshop/connect-cms.
