PT-2024-30566 · Ghost · Ghost
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ghost versions 4.46.0 through 5.89.4
Description
The issue is related to improper authentication on some endpoints used for member actions, allowing an attacker to perform member-only actions and read member information.
Recommendations
For Ghost versions 4.46.0 through 5.89.4, update to version 5.89.5 to resolve the issue.
As a temporary workaround, consider disabling site membership in Ghost settings until the update is applied.
Exploit
Fix
Improper Authentication
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ghost