PT-2026-104226 · Ghost · Ghost
CVSS v3.1
3.1
منخفضة
| المتجه | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Ghost versions 0.7.2 through 6.63.0
Description
An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is achieved by querying the Admin API to infer hash ordering, although the flaw does not directly expose the hashes or facilitate practical password recovery.
Recommendations
Update Ghost to version 6.64.0 or later.
استغلال
إصلاح
Side Channel Attack
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Ghost