CVE-2024-23724

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile pictur...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami ghost

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.82.11"}]}]

参照URL

advisory nvd.nist.gov
advisory github.com
patch github.com
web github.com
web rhinosecuritylabs.com