CVE-2022-47194

2023-01-1917:02:10

CWE-453

talos

www.cve.org

cve-2022-47194

ghost foundation

insecure default

post creation

privilege escalation

xss

http request

stored xss vulnerability

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

23.5%

JSON

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the twitter field for a user.

CNA Affected

[
  {
    "vendor": "Ghost Foundation",
    "product": "Ghost",
    "versions": [
      {
        "version": "5.9.4",
        "status": "affected"
      }
    ]
  }
]