NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

Connect-CMS Access control vulnerabilityGHSA-5rjc-jc28-cwgg

MEDIUM

GHSA-5rjc-jc28-cwgg is a medium-severity (CVSS 4.3) vulnerability in opensource-workshop/connect-cms. A fix is available for opensource-workshop/connect-cms — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Feb 7, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐘opensource-workshop/connect-cms🐘opensource-workshop/connect-cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact（影響）

There is an Access control vulnerability on the management system of Connect-CMS. Affected Version : Connect-CMS v1.8.6, 2.4.6 and earlier

Patches（修正バージョン）

version v1.8.7, v2.4.7

Workarounds（運用回避手段）

Upgrade Connect-CMS to latest version

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistopensource-workshop/connect-cmsall versions1.8.7composer require opensource-workshop/connect-cms:^1.8.7
🐘Packagistopensource-workshop/connect-cms≥ 2.0.0&&< 2.4.72.4.7composer require opensource-workshop/connect-cms:^2.4.7

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for opensource-workshop/connect-cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update opensource-workshop/connect-cms to 1.8.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5rjc-jc28-cwgg is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

### Impact（影響） There is an Access control vulnerability on the management system of Connect-CMS. Affected Version : Connect-CMS v1.8.6, 2.4.6 and earlier ### Patches（修正バージョン） version v1.8.7, v2.4.7 ### Workarounds（運用回避手段） Upgrade Connect-CMS to latest version
O3 Security · Impact-Aware SCA

Is GHSA-5rjc-jc28-cwgg in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Connect-CMS Access control vulnerability (Medium 4.3)