p PatchFirst

CVE-2022-41654

CVE-2022-41654

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

CVSS 9.6 · Critical · EPSS 18.9% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • 5.9.4: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.22.7

    Update to 5.22.7

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 4.46.0, < 4.48.8

    Update to 4.48.8

Original sources

Check your server →