CVE-2024-34451

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with di...

Original description

The description as published by the source.

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami ghost

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.110.4"}]}]

References

advisory nvd.nist.gov
advisory github.com
package github.com
web docs.google.com
web ghost.org