Improper Access Control Affecting ghost package, versions >=4.46.0 <4.48.8 >=5.0.0 <5.22.7
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-GHOST-3150398
- published 29 Nov 2022
- disclosed 28 Nov 2022
- credit Dave McDaniel
Introduced: 28 Nov 2022
CVE-2022-41654 Open this link in a new tabHow to fix?
Upgrade ghost to version 4.48.8, 5.22.7 or higher.
Overview
ghost is a publishing platform
Affected versions of this package are vulnerable to Improper Access Control due to improper validation of nested objects via the Memebers API, which allows members to make changes to newsletter settings.
Exploiting this vulnerability allows unprivileged users to view and change settings they were not intended to have access to.
NOTE: By exploiting this vulnerability, it is not possible to escalate privileges permanently or get access to further information.
Workarounds:
The known exploit can be prevented by disabling members until an update can be performed.