PT-2024-30566 · Ghost · Ghost

1337Nerd · Published 2024-08-20 · Updated 2025-07-29 · CVE-2024-43409

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghost versions 4.46.0 through 5.89.4

Description The issue is related to improper authentication on some endpoints used for member actions, allowing an attacker to perform member-only actions and read member information.

Recommendations For Ghost versions 4.46.0 through 5.89.4, update to version 5.89.5 to resolve the issue. As a temporary workaround, consider disabling site membership in Ghost settings until the update is applied.

Exploit

Fix

Improper Access Control

Improper Authentication

Weakness Enumeration

CWE-284

CWE-287

Related Identifiers

BIT-GHOST-2024-43409

CVE-2024-43409

GHSA-78X2-CWP9-5J42

Affected Products

Ghost

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43409.json · Exploit
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42 · Vendor Advisory
• https://github.com/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db · Patch
• https://osv.dev/vulnerability/CVE-2024-43409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43409 · Security Note
• https://osv.dev/vulnerability/GHSA-78x2-cwp9-5j42 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ghost-2024-43409 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://twitter.com/ptuladhar3/status/1950067844189770023 · Twitter Post
• https://twitter.com/CVEnew/status/1825918395860058590 · Twitter Post
• https://t.me/cvedetector/3647 · Telegram Post