Vulnerability Description
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ghost | Ghost | >= 4.46.0, < 4.48.8 |
Related Weaknesses (CWE)
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-9gh8-wp53-ccc6Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1624ExploitThird Party Advisory
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-9gh8-wp53-ccc6Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1624ExploitThird Party Advisory
FAQ
What is CVE-2022-41654?
CVE-2022-41654 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attack...
How severe is CVE-2022-41654?
CVE-2022-41654 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-41654?
Check the references section above for vendor advisories and patch information. Affected products include: Ghost Ghost.