CVE-2022-41697

2022-12-2200:00:00

CWE-204

talos

www.cve.org

user enumeration

ghost foundation

http request

information disclosure

vulnerability

security

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.4%

JSON

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

CNA Affected

[
  {
    "vendor": "Ghost Foundation",
    "product": "Ghost",
    "versions": [
      {
        "version": "5.9.4",
        "status": "affected"
      }
    ]
  }
]