Incomplete List of Disallowed Inputs

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through the isPrivateIp logic in core/server/lib/request-external.js. An attacker can make Ghost send server-side requests to internal services by supplying an external...