Lucene search

GoogleOSV:BIT-GHOST-2022-41697

HistoryMar 06, 2024 - 10:53 a.m.

BIT-ghost-2022-41697

2024-03-0610:53:30

Google

osv.dev

user enumeration

http request

sensitive information disclosure

attacker

vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.4%

JSON

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

CPENameOperatorVersion
ghostge5.9.4
ghostle5.9.4

CPE	Name	Operator	Version
	ghost	ge	5.9.4
	ghost	le	5.9.4

References

talosintelligence.com/vulnerability_reports/TALOS-2022-1625

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.4%

JSON

Related for OSV:BIT-GHOST-2022-41697