CVE-2022-47194
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the twitter field for a user.
影響パッケージ
Bitnami
ghost
[{"type":"SEMVER","events":[{"introduced":"5.9.4"},{"fixed":"5.9.5"}]}]
参照URL
- advisory nvd.nist.gov
- advisory github.com
- web talosintelligence.com
- web talosintelligence.com