Lucene search

GitHub Advisory DatabaseGHSA-XGWH-CGV9-783V

HistoryMay 22, 2024 - 6:30 p.m.

Ghost allows CSV Injection during member CSV export

2024-05-2218:30:40

CWE-74

GitHub Advisory Database

github.com

ghost

version 5.82.0

csv injection

member export

software

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

JSON

Ghost before 5.82.0 allows CSV Injection during a member CSV export.

Affected configurations

Vulners

Node

tryghostmembers-csvRange<5.82.0

VendorProductVersionCPE
tryghostmembers-csv*cpe:2.3:a:tryghost:members-csv:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tryghost	members-csv	*	cpe:2.3:a:tryghost:members-csv::::::::

References

github.com/advisories/GHSA-xgwh-cgv9-783v

github.com/phulelouch/CVEs/blob/main/CVE-2024-34448.md

github.com/TryGhost/Ghost/commit/de668e7950a019a204b2df0c84596ea0fa32cce6

nvd.nist.gov/vuln/detail/CVE-2024-34448

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

JSON

Related for GHSA-XGWH-CGV9-783V