Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Security Advisory — My Page Profile Update (Improper Authorization) Summary An improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Affected Versions - 1.x series: <= 1.41.0 - 2.x series: <= 2.41.0 Patched Versions - 1.41.1 - 2.41.1 Description In part of the My Page profile update feature, another user's profile information or password could be modified. If exploited, arbitrary user accounts may be taken over. Exploitation requires that the attacker be able to reach the affected functionality as an authenticated user. Users affected by this vulnerability should update to a fixed version. Solution Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later. Credits OpenSource WorkShops thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Recommended action: Upgrade to 2.41.1 or 1.41.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Advisory — Page Content Retrieval (Improper Authorization) Summary An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Affected Versions - 1.x series: <= 1.41.0 - 2.x series: <= 2.41.0 Patched Versions - 1.41.1 - 2.41.1 Description In part of the page content retrieval feature, insufficient authorization checks could allow processing associated with non-public pages to be executed. If exploited, the contents and attachments of non-public pages may be obtained by a third party. Users affected by this vulnerability should update to a fixed version. Solution Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later. Credits OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Recommended action: Upgrade to 2.41.1 or 1.41.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Advisory — Page Management Plugin (SSRF) Summary A Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Affected Versions - 1.x series: <= 1.41.0 - 2.x series: <= 2.41.0 Patched Versions - 1.41.1 - 2.41.1 Description In the external page migration feature of the Page Management Plugin, a Server-Side Request Forgery (SSRF) issue could occur. If exploited, it may allow access to internal destinations and could result in information disclosure. Exploitation requires privileges that allow use of the page management screen. Users affected by this vulnerability should update to a fixed version. Solution Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later. Credits OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Recommended action: Upgrade to 2.41.1 or 1.41.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Advisory — Form Plugin (Stored XSS) Summary A Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Affected Versions - 1.x series: <= 1.41.0 - 2.x series: <= 2.41.0 Patched Versions - 1.41.1 - 2.41.1 Description In the file field of the Form Plugin, Stored Cross-site Scripting (XSS) could occur. If exploited, arbitrary script could run in an administrator's browser, which may lead to unauthorized actions or information theft. Users affected by this vulnerability should update to a fixed version. Solution Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later. Credits OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Recommended action: Upgrade to 2.41.1 or 1.41.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Advisory — Cabinet Plugin (DOM-based XSS) Summary A DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Affected Versions - 1.x series: = 1.35.0, <= 1.41.0 - 2.x series: = 2.35.0, <= 2.41.0 Patched Versions - 1.41.1 - 2.41.1 Description In the Cabinet Plugin list view, DOM-based Cross-Site Scripting (XSS) could occur due to how saved names were rendered. If exploited, arbitrary script could run in the victim's browser, which may lead to unauthorized actions or information theft. Exploitation requires that the attacker be able to reach the affected functionality as an authenticated user. Users affected by this vulnerability should update to a fixed version. Solution Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later. Credits OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Recommended action: Upgrade to 2.41.1 or 1.41.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Advisory — Code Study Plugin Summary An authenticated user may be able to execute arbitrary code in the Code Study Plugin. Affected Versions - 1.x series: <= 1.41.0 - 2.x series: <= 2.41.0 Patched Versions - 1.41.1 - 2.41.1 Description In the Code Study Plugin, an authenticated user could trigger unintended code execution. If exploited, it may lead to code execution on the server or information disclosure. Users affected by this vulnerability should update to a fixed version. Solution Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later. Credits OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
Recommended action: Upgrade to 2.41.1 or 1.41.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact - Information that is restricted from viewing in the search results of site searches (※) can still be viewed via the main text (a feature added in v1.8.0). - Impact by version - v1.8.0 ~ v1.8.3: It will be displayed in the text. - v1.8.0 and earlier: It will not be displayed in the body of the text, but the title (frame name) will be displayed with a link. - Target viewing restriction function - Frame publishing function (private, limited publishing) - IP Restriction Page - Password setting page Patches (fixed version) - Apply v1.8.4. Workarounds - Remove the site search (e.g. hide frames).。 References none
Recommended action: Upgrade to 1.8.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact（影響） There is an Access control vulnerability on the management system of Connect-CMS. Affected Version : Connect-CMS v1.8.6, 2.4.6 and earlier Patches（修正バージョン） version v1.8.7, v2.4.7 Workarounds（運用回避手段） Upgrade Connect-CMS to latest version
Recommended action: Upgrade to 2.4.7 or 1.8.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact（影響） There is a Privilege Escalation Vulnerability on the management system of Connect-CMS. Affercted Version : Connect-CMS 1.7.1, 2.3.1 and earlier Patches（修正バージョン） version 1.7.2, 2.3.1 Workarounds（運用回避手段） Upgrade Connect-CMS to latest version
Recommended action: Upgrade to 2.3.2 or 1.7.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.