ghost@2.0.0 vulnerabilities

ghost is a publishing platform

Affected versions of this package are vulnerable to Improper Neutralization of Formula Elements in a CSV File during a member CSV export. An attacker can execute arbitrary commands by injecting maliciously crafted CSV content.

Upgrade ghost to version 5.82.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an SVG profile picture upload. A contributor user can cause scripts to be executed as owner.

Upgrade ghost to version 5.83.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the excerpt.js component. An attacker can inject and execute arbitrary script code in the context of the user's browser session by crafting a malicious post excerpt.

Upgrade ghost to version 5.76.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Arbitrary File Read which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system.

Note: Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's content/ folder.

Upgrade ghost to version 5.59.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Directory Traversal due to allowing remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/. This occurs in frontend/web/middleware/static-theme.js file.

Upgrade ghost to version 5.42.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Information Exposure such that due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.

Upgrade ghost to version 5.46.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Access Restriction Bypass that allows contributors to view draft posts of other users via the /ghost/api/admin/posts endpoint and draft pages of other users via the /ghost/api/admin/pages endpoint.

NOTE: The vendor's position is that this behavior has no security impact.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the codeinjection_foot field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the codeinjection_head field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the facebook field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the twitter field, which allows users to inject JavaScript into posts.

There is no fixed version for ghost.

ghost is a publishing platform

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via a file that has previously been uploaded using the file upload functionality in the post editor.

Upgrade ghost to version 4.48.2, 5.2.3 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Command Injection. Sites using the sendmail transport as part of their mail config are vulnerable to remote command injection due to a vulnerability in the nodemailer dependency. Ghost defaults to the direct transport so this is only exploitable if the sendmail transport is explicitly used.

Upgrade ghost to version 4.15.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Open Redirect. It allows redirecting to external sites after providing private site password.

Upgrade ghost to version 3.41.1 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Open Redirect. It is possible for an attack to redirect a user to an external sit after providing a private site password.

Upgrade ghost to version 2.38.3 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). It provides an attacker the ability of Internal port scanning, or reading oembed contents from the internal network.

Upgrade ghost to version 2.38.2 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF). Previously, when Ghost could not determine an origin of a request it would return a null value as a default, thereby allowing for requests sent from origins other than the domains the user logged in from.

Upgrade ghost to version 3.13.0 or higher.

ghost is a publishing platform

Affected versions of this package are vulnerable to Server Side Request Forgery (SSRF). The getOembedUrlFromHTML() function does not sanitize user input.

Upgrade ghost to version 2.38.1, 3.10.0 or higher.