Access Restriction Bypass Affecting ghost package, versions >=4.0.0 <4.10.0
Threat Intelligence
EPSS
0.12% (48th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-GHOST-1325348
- published 23 Jul 2021
- disclosed 22 Jul 2021
- credit Aden Yap Chuen Zhen, BAE Systems Applied Intelligence
Introduced: 22 Jul 2021
CVE-2021-39192 Open this link in a new tabHow to fix?
Upgrade ghost to version 4.10.0 or higher.
Overview
ghost is a publishing platform
Affected versions of this package are vulnerable to Access Restriction Bypass. An error in the implementation of the limits service in 4.0.0 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability.
References
CVSS Scores
version 3.1