Authentication Bypass Affecting ghost package, versions [,0.5.9)
Snyk CVSS
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-GHOST-60160
- published 22 Mar 2017
- disclosed 22 Mar 2017
- credit Matteo Beccaro
Introduced: 22 Mar 2017
CVE-2015-1409 Open this link in a new tabHow to fix?
Upgrade ghost to version 0.5.9 or higher.
Overview
ghost is a blogging platform.
Affected versions of the package are vulnerable to Authentication Bypass. An authenticated user can spoof an HTTP GET request with any username to access any other users’ drafts. This is due to the user parameter not being validated upon the request.