CVE-2024-43409

Published: Aug 20, 2024Modified: Aug 26, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.

Affected (1)

Products: Ghost: Ghost

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ghost Ghost	From 4.46.0 to 5.89.5

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://github.com/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db

Source: security-advisories@github.com

Patch

https://github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.