NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

Connect-CMS information that is restricted to viewing is visibleGHSA-2237-5r9w-vm8j

GHSA-2237-5r9w-vm8j is a security vulnerability in opensource-workshop/connect-cms. A fix is available for opensource-workshop/connect-cms — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Feb 7, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘opensource-workshop/connect-cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

  • Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0).
    • Impact by version
      • v1.8.0 ~ v1.8.3: It will be displayed in the text.
      • v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link.
    • Target viewing restriction function
      • Frame publishing function (private, limited publishing)
      • IP Restriction Page
      • Password setting page

Patches (fixed version)

  • Apply v1.8.4.

Workarounds

  • Remove the site search (e.g. hide frames).。

References

none

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistopensource-workshop/connect-cmsall versions1.8.4composer require opensource-workshop/connect-cms:^1.8.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for opensource-workshop/connect-cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update opensource-workshop/connect-cms to 1.8.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2237-5r9w-vm8j is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact - Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0). - Impact by version - v1.8.0 ~ v1.8.3: It will be displayed in the text. - v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link. - Target viewing restriction function - Frame publishing function (private, limited publishing) - IP Restriction Page - Password setting page ### Patches (fixed version) -
O3 Security · Impact-Aware SCA

Is GHSA-2237-5r9w-vm8j in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Connect-CMS information that is restricted to viewing is…