Doanmanhducz

**اسم البرنامج المصاب والإصدارات المتأثرة** Craft CMS الإصدارات من 5.0.0 إلى 5.10.13 **الوصف** توجد ثغرة cross-site scripting قائمة على DOM في تدفق تسجيل الدخول إلى لوحة التحكم والتحقق من المصادقة الثنائية (2FA). تحدث المشكلة لأن المتغير `returnUrl` الذي يتحكم فيه المستخدم يقبل روابط javascript: أثناء التنقل من جانب العميل. يمكن للمهاجم استدراج ضحية مفعلة للمصادقة الثنائية لفتح نقطة النهاية '/admin/login?verify=1' المصممة خصيصاً بين مرحلتي تقديم كلمة المرور والتحقق من TOTP (كلمة المرور لمرة واحدة المستندة إلى الوقت). يؤدي ذلك إلى تنفيذ JavaScript تعسفي داخل لوحة التحكم المصادق عليها بصلاحيات الضحية. **التوصيات** تحديث Craft CMS إلى الإصدار 5.10.14 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** Ghost versions 6.22.1 through 6.63.0 **Description** Ghost is a Node.js content management system. When using the default local storage adapter, the system fails to restrict the content type of uploaded files. This allows files uploaded by staff users to be served with a content type based on their file extension, which can be exploited to host scripts on the site domain and potentially compromise the admin sessions of other staff users. **Recommendations** Update to version 6.64.0.

**Name of the Vulnerable Software and Affected Versions** Ghost versions 6.22.1 through 6.63.x **Description** A stored cross-site scripting issue exists where staff users can host malicious scripts by uploading files that are served with extension-derived content types using the default local storage adapter. This allows an attacker to upload script-bearing files to the site domain to compromise the admin sessions of other staff users. **Recommendations** Update Ghost to version 6.64.0 or later.

**Name of the Vulnerable Software and Affected Versions** Ghost versions prior to 6.62.0 **Description** An authentication bypass exists during the staff invite acceptance process. This issue allows users to specify any email address when creating their account, enabling attackers to use leaked invite tokens with email addresses they control. Additionally, legitimate recipients may register using unintended email providers. **Recommendations** Update to version 6.62.0 or later.

**Name of the Vulnerable Software and Affected Versions** Ghost versions 6.20.0 through 6.57.0 **Description** Improper session management allows authenticated staff users to log in as any other staff user using only a password, which bypasses two-factor authentication. This enables attackers with valid staff credentials to impersonate other staff members and gain unauthorized access to administrative functions. **Recommendations** Update Ghost to version 6.57.1 or later.

**Name of the Vulnerable Software and Affected Versions** Ghost versions 5.125.1 through 6.57.0 **Description** An information disclosure issue exists in the Admin Feedback endpoint. Staff users with limited privileges can query this endpoint to retrieve sensitive member data because the system fails to perform proper authorization checks. **Recommendations** Update Ghost to version 6.57.1 or later. Restrict access to the Admin Feedback endpoint for staff users with low privilege levels as a temporary mitigation.