Skip to content

Commit 97be43c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-62ch-j6x7-722j GHSA-jh46-85jr-6ph9 GHSA-mv3p-7p89-wq9p
1 parent 7016f16 commit 97be43c

3 files changed

Lines changed: 274 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-62ch-j6x7-722j/GHSA-62ch-j6x7-722j.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-62ch-j6x7-722j",
4+
"modified": "2026-03-23T20:38:16Z",
5+
"published": "2026-03-23T20:38:16Z",
6+
"aliases": [
7+
"CVE-2026-32299"
8+
],
9+
"summary": "Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature",
10+
"details": "# Security Advisory — Page Content Retrieval (Improper Authorization)\n\n## Summary\n\nAn improper authorization issue in the page content retrieval feature may allow retrieval of non-public information.\n\n## Affected Versions\n\n- 1.x series: <= 1.41.0\n- 2.x series: <= 2.41.0\n\n## Patched Versions\n\n- 1.41.1\n- 2.41.1\n\n## Description\n\nIn part of the page content retrieval feature, insufficient authorization checks could allow processing associated with non-public pages to be executed. If exploited, the contents and attachments of non-public pages may be obtained by a third party. Users affected by this vulnerability should update to a fixed version.\n\n## Solution\n\nUpdate to the fixed version.\nFor the 1.x series, update to 1.41.1 or later.\nFor the 2.x series, update to 2.41.1 or later.\n\n## Credits\n\nOpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "opensource-workshop/connect-cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.41.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.40.0"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "opensource-workshop/connect-cms"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "2.0.0"
51+
},
52+
{
53+
"fixed": "2.41.1"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 2.40.0"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-62ch-j6x7-722j"
67+
},
68+
{
69+
"type": "PACKAGE",
70+
"url": "https://github.com/opensource-workshop/connect-cms"
71+
}
72+
],
73+
"database_specific": {
74+
"cwe_ids": [
75+
"CWE-284"
76+
],
77+
"severity": "HIGH",
78+
"github_reviewed": true,
79+
"github_reviewed_at": "2026-03-23T20:38:16Z",
80+
"nvd_published_at": null
81+
}
82+
}

‎advisories/github-reviewed/2026/03/GHSA-jh46-85jr-6ph9/GHSA-jh46-85jr-6ph9.json‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jh46-85jr-6ph9",
4+
"modified": "2026-03-23T20:36:49Z",
5+
"published": "2026-03-23T20:36:49Z",
6+
"aliases": [
7+
"CVE-2026-32279"
8+
],
9+
"summary": "Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin",
10+
"details": "# Security Advisory — Page Management Plugin (SSRF)\n\n## Summary\n\nA Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin.\n\n## Affected Versions\n\n- 1.x series: <= 1.41.0\n- 2.x series: <= 2.41.0\n\n## Patched Versions\n\n- 1.41.1\n- 2.41.1\n\n## Description\n\nIn the external page migration feature of the Page Management Plugin, a Server-Side Request Forgery (SSRF) issue could occur. If exploited, it may allow access to internal destinations and could result in information disclosure. Exploitation requires privileges that allow use of the page management screen. Users affected by this vulnerability should update to a fixed version.\n\n## Solution\n\nUpdate to the fixed version.\nFor the 1.x series, update to 1.41.1 or later.\nFor the 2.x series, update to 2.41.1 or later.\n\n## Credits\n\nOpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "opensource-workshop/connect-cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.41.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.41.0"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "opensource-workshop/connect-cms"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "2.0.0"
51+
},
52+
{
53+
"fixed": "2.41.1"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 2.41.0"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-jh46-85jr-6ph9"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/opensource-workshop/connect-cms/commit/4a1a64a8f768a53e06a4239e25782d9e2e88fc63"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/opensource-workshop/connect-cms/commit/617a874e14b8476da7c0760a06384b9da21bdd4f"
75+
},
76+
{
77+
"type": "PACKAGE",
78+
"url": "https://github.com/opensource-workshop/connect-cms"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1"
87+
}
88+
],
89+
"database_specific": {
90+
"cwe_ids": [
91+
"CWE-918"
92+
],
93+
"severity": "MODERATE",
94+
"github_reviewed": true,
95+
"github_reviewed_at": "2026-03-23T20:36:49Z",
96+
"nvd_published_at": null
97+
}
98+
}

‎advisories/github-reviewed/2026/03/GHSA-mv3p-7p89-wq9p/GHSA-mv3p-7p89-wq9p.json‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mv3p-7p89-wq9p",
4+
"modified": "2026-03-23T20:36:15Z",
5+
"published": "2026-03-23T20:36:15Z",
6+
"aliases": [
7+
"CVE-2026-32278"
8+
],
9+
"summary": "Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin",
10+
"details": "# Security Advisory — Form Plugin (Stored XSS)\n\n## Summary\n\nA Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin.\n\n## Affected Versions\n\n- 1.x series: <= 1.41.0\n- 2.x series: <= 2.41.0\n\n## Patched Versions\n\n- 1.41.1\n- 2.41.1\n\n## Description\n\nIn the file field of the Form Plugin, Stored Cross-site Scripting (XSS) could occur. If exploited, arbitrary script could run in an administrator's browser, which may lead to unauthorized actions or information theft. Users affected by this vulnerability should update to a fixed version.\n\n## Solution\n\nUpdate to the fixed version.\nFor the 1.x series, update to 1.41.1 or later.\nFor the 2.x series, update to 2.41.1 or later.\n\n## Credits\n\nOpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "opensource-workshop/connect-cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.41.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 1.41.0"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "opensource-workshop/connect-cms"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "2.0.0"
51+
},
52+
{
53+
"fixed": "2.41.1"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 2.41.0"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-mv3p-7p89-wq9p"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/opensource-workshop/connect-cms/commit/9d87fe8ecf7f57efbb0e5231be058807734c96b3"
71+
},
72+
{
73+
"type": "PACKAGE",
74+
"url": "https://github.com/opensource-workshop/connect-cms"
75+
},
76+
{
77+
"type": "WEB",
78+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1"
83+
}
84+
],
85+
"database_specific": {
86+
"cwe_ids": [
87+
"CWE-434"
88+
],
89+
"severity": "HIGH",
90+
"github_reviewed": true,
91+
"github_reviewed_at": "2026-03-23T20:36:15Z",
92+
"nvd_published_at": null
93+
}
94+
}

0 commit comments

Comments
 (0)