Connect-CMS information that is restricted to viewing is visible
The advisory, in context
Impact
- Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0).
- Impact by version
- v1.8.0 ~ v1.8.3: It will be displayed in the text.
- v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link.
- Target viewing restriction function
- Frame publishing function (private, limited publishing)
- IP Restriction Page
- Password setting page
- Impact by version
Patches (fixed version)
- Apply v1.8.4.
Workarounds
- Remove the site search (e.g. hide frames).。
References
none
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.8.4
Fixed in 1.8.4
51 explicitly affected versions
v0.0.1.20200106, v0.0.1.20200216, v0.0.1.20200302, v0.0.1.20200411, v0.0.1.20200510, v0.0.1.20200603, v0.0.1.20200716, v0.0.1.20200909, v0.0.1.20201008, v0.0.1.20201207, v0.0.1.20210104, v0.0.1.20210301, v0.0.1.20210405, v0.0.1.20211130, v0.0.1.20220207, v1.0.0, v1.1.0, v1.1.1, v1.1.2, v1.1.3, v1.2.0, v1.2.1, v1.2.2, v1.2.3, v1.2.4, v1.2.5, v1.2.6, v1.2.7, v1.2.8, v1.3.0, v1.3.1, v1.3.2, v1.4.0, v1.4.1, v1.4.2, v1.4.3, v1.4.4, v1.5.0, v1.5.1, v1.5.2, v1.5.3, v1.6.0, v1.6.1, v1.6.2, v1.7.0, v1.7.1, v1.7.2, v1.8.0, v1.8.1, v1.8.2, v1.8.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v0.0.1.20200106",
"v0.0.1.20200216",
"v0.0.1.20200302",
"v0.0.1.20200411",
"v0.0.1.20200510",
"v0.0.1.20200603",
"v0.0.1.20200716",
"v0.0.1.20200909",
"v0.0.1.20201008",
"v0.0.1.20201207",
"v0.0.1.20210104",
"v0.0.1.20210301",
"v0.0.1.20210405",
"v0.0.1.20211130",
"v0.0.1.20220207",
"v1.0.0",
"v1.1.0",
"v1.1.1",
"v1.1.2",
"v1.1.3",
"v1.2.0",
"v1.2.1",
"v1.2.2",
"v1.2.3",
"v1.2.4",
"v1.2.5",
"v1.2.6",
"v1.2.7",
"v1.2.8",
"v1.3.0",
"v1.3.1",
"v1.3.2",
"v1.4.0",
"v1.4.1",
"v1.4.2",
"v1.4.3",
"v1.4.4",
"v1.5.0",
"v1.5.1",
"v1.5.2",
"v1.5.3",
"v1.6.0",
"v1.6.1",
"v1.6.2",
"v1.7.0",
"v1.7.1",
"v1.7.2",
"v1.8.0",
"v1.8.1",
"v1.8.2",
"v1.8.3"
]
}