PT-2023-15233 · Ghost · Ghost

Dave Mcdaniel · Publicado 2023-01-19 · Atualizado 2024-03-06 · CVE-2022-47194

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.4

Description An insecure default issue exists in the Post Creation functionality, allowing non-administrator users to inject arbitrary Javascript in posts. This enables privilege escalation to administrator via XSS. An attacker can trigger this by sending an HTTP request to inject Javascript in a post, tricking an administrator into visiting it. A stored XSS issue also exists in the twitter field for a user.

Recommendations For version 5.9.4, consider disabling the Post Creation functionality until a patch is available. Restrict access to the twitter field to minimize the risk of exploitation. Avoid using the twitter field in user profiles until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-1188

CWE-79

CWE-453

Identificadores relacionados

BIT-GHOST-2022-47194

CVE-2022-47194

Produtos afetados

Ghost

Referências · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-47194 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-47194 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-ghost-2022-47194 · Aviso do Fabricante
• https://t.me/cibsecurity/56732 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47194 · Nota