PT-2021-24466 · Unknown+1 · Nodemailer+1

Published 2021-09-20 · Updated 2021-09-20

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Ghost versions prior to 4.15.0

Description: The issue affects sites using the sendmail transport as part of their mail config, making them vulnerable to remote command injection due to a problem in the nodemailer dependency. Ghost defaults to the direct transport, so this is only exploitable if the sendmail transport is explicitly used.

Recommendations: For versions prior to 4.15.0, upgrade to version 4.15.0 as soon as possible. As a temporary workaround, consider using an alternative email transport as described in the documentation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

GHSA-WFRJ-QQC2-83CM

Affected Products

Ghost

Nodemailer

References · 5

• https://osv.dev/vulnerability/GHSA-wfrj-qqc2-83cm · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-wfrj-qqc2-83cm · Note
• https://github.com/TryGhost/Ghost/commit/93e4b2eafd18bc8e4c17924e0824e73617e7940c · Note
• https://github.com/advisories/GHSA-48ww-j4fc-435p · Note