GHSA-qxh3-jgvh-x55j: Connect-CMS Privilege Escalation Vulnerability
4.3
CVSS Score
3.1
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
7/5/2023
Updated
2/7/2025
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
opensource-workshop/connect-cms | composer | < 1.7.2 | 1.7.2 |
opensource-workshop/connect-cms | composer | >= 2.0.0, < 2.3.2 | 2.3.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The provided vulnerability information lacks technical details about code implementation, commit diffs, or patch specifics. While the advisory describes a privilege escalation vulnerability, there are no explicit references to vulnerable functions, file paths, or code patterns in the management system. Privilege escalation typically involves authorization flaws, but without access to the actual code changes between vulnerable and patched versions (e.g., user role validation
functions, permission checks
), specific vulnerable functions cannot be identified with high confidence. The absence of CWE mappings, GitHub
patch details, or commit comparisons further limits the ability to pinpoint exact functions.