Authentication Bypass Affecting ghost package, versions <0.5.9
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:ghost:20150303-3
- published 30 May 2017
- disclosed 2 Mar 2015
- credit Matteo Beccaro
Introduced: 2 Mar 2015
CVE-2015-1408 Open this link in a new tabHow to fix?
Upgrade ghost to version 0.5.9 or higher.
Overview
ghost is a blogging platform.
Affected versions of the package are vulnerable to Authentication Bypass via Privilege Reduction. An attacker can change the privileges of other users, and update their email.
CVSS Scores
version 3.1