PT-2022-26007 · Ghost Foundation · Ghost

Dave Mcdaniel

·

Published

2022-11-28

·

Updated

2024-03-06

·

CVE-2022-41654

CVSS v3.1

9.6

Critical

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ghost Foundation Ghost versions 4.46.0 through 4.48.7 Ghost Foundation Ghost versions 5.0.0 through 5.22.6 Ghost Foundation Ghost version 5.9.4
Description An authentication bypass vulnerability exists in the newsletter subscription functionality. A specially-crafted HTTP request can lead to increased privileges. This issue was caused by a gap in API validation for nested objects, allowing unprivileged users to make changes to newsletter settings and view or change settings they were not intended to have access to.
Recommendations For Ghost Foundation Ghost versions 4.46.0 through 4.48.7, update to version 4.48.8 or later. For Ghost Foundation Ghost versions 5.0.0 through 5.22.6, update to version 5.22.7 or later. For Ghost Foundation Ghost version 5.9.4, update to a newer version that contains a fix for this issue. As a temporary workaround, consider disabling members until an update can be performed.

Exploit

Fix

Improper Access Control

Weakness Enumeration

Related Identifiers

BIT-GHOST-2022-41654
CVE-2022-41654
GHSA-9GH8-WP53-CCC6

Affected Products

Ghost