CVE-2022-41654

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
talosCNA
9.6 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
VendorProductVersion
ghostghost
4.46.0 ≤
𝑥
< 4.48.8
ghostghost
5.0.0 ≤
𝑥
< 5.22.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/TryGhost/Ghost/security/advisories/GHSA-9gh8-wp53-ccc6
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1624
https://github.com/TryGhost/Ghost/security/advisories/GHSA-9gh8-wp53-ccc6
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1624