PT-2024-20036 · Ghost · Ghost

Joeldesante · Published 2024-01-20 · Updated 2026-02-18 · CVE-2024-23725

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 5.76.0

Description The issue allows for cross-site scripting (XSS) via a post excerpt in excerpt.js, where an XSS payload can be rendered in post summaries. There have been reports of increased actor activities targeting this issue.

Recommendations For versions prior to 5.76.0, update to version 5.76.0 or later to resolve the issue. As a temporary workaround, consider restricting the rendering of post excerpts in excerpt.js to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-GHOST-2024-23725

CVE-2024-23725

GHSA-FH38-9FGR-454W

Affected Products

Ghost

References · 15

• https://github.com/TryGhost/Ghost/releases/tag/v5.76.0 · Patch
• https://github.com/TryGhost/Ghost/pull/17190 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-23725 · Security Note
• https://osv.dev/vulnerability/BIT-ghost-2024-23725 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh38-9fgr-454w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23725 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://t.me/cvenotify/68158 · Telegram Post
• https://twitter.com/vuldb/status/1865750688007172288 · Twitter Post
• https://t.me/cvenotify/69073 · Telegram Post
• https://twitter.com/CVEnew/status/1748913033450270873 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1748957249072959769 · Twitter Post
• https://twitter.com/dailycve/status/2024247151350423885 · Twitter Post
• https://t.me/cvenotify/68202 · Telegram Post
• https://github.com/yunaycompany/Ghost/commit/64d67717f7c76c77b3908e15627f473e9ef34002 · Note