PT-2021-22447 · Ghost · Ghost

Aden Yap Chuen Zhen + 1 · Published 2021-07-22 · Updated 2024-03-06 · CVE-2021-39192

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 4.9.4

Description An error in the implementation of the limits service allows all authenticated users, including contributors, to view admin-level API keys via the "integrations API endpoint", leading to a privilege escalation issue. This allows unauthorized access to sensitive information. It is highly recommended to regenerate all API keys after patching or applying the workaround.

Recommendations For Ghost versions 4.0.0 through 4.9.4, upgrade to version 4.10.0 as soon as possible. As a temporary workaround, consider disabling all non-Administrator accounts to prevent API access. After patching or applying the workaround, regenerate all API keys to ensure security.

Fix

Improper Privilege Management

Information Disclosure

Weakness Enumeration

CWE-269

CWE-200

Related Identifiers

BIT-GHOST-2021-39192

CVE-2021-39192

GHSA-J5C2-HM46-WP5C

Affected Products

Ghost

References · 9

• https://osv.dev/vulnerability/BIT-ghost-2021-39192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5c2-hm46-wp5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39192 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39192 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c · Note
• https://github.com/TryGhost/Ghost/releases/tag/v4.10.0 · Note
• https://t.me/cibsecurity/28262 · Telegram Post
• https://t.me/cvenotify/20644 · Telegram Post