CVE-2022-47195
Last modified
CVE-2022-47195 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. EPSS estimates a 0.68% chance of exploitation in the next 30 days.
Description
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ghost | Ghost | 5.9.4 |
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686Exploit, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-47195?
How severe is CVE-2022-47195?
How do I fix CVE-2022-47195?
Are you affected by CVE-2022-47195?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST