CVE-2024-34451

Published: Jun 16, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.

Affected (1)

Products: Ghost: Ghost

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ghost Ghost	Up to 5.85.1

Related CWEs

Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

References (6)

https://docs.google.com/document/d/1iy0X4Vc9xXYoBxFrcW6ATo8GKPV6ivuLVzn6GgEpwqE

Source: cve@mitre.org

Exploit

https://ghost.org/docs/faq/proxying-https-infinite-loops/

Source: cve@mitre.org

Product

https://github.com/TryGhost/Ghost/releases

Source: cve@mitre.org

Product

https://docs.google.com/document/d/1iy0X4Vc9xXYoBxFrcW6ATo8GKPV6ivuLVzn6GgEpwqE

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://ghost.org/docs/faq/proxying-https-infinite-loops/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://github.com/TryGhost/Ghost/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.