CVE-2022-28397: Malicious File Upload
DISPUTED An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-28397?
CVE-2022-28397 is an arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0.
How severe is CVE-2022-28397?
CVE-2022-28397 has a severity rating of 9.8 (critical).
How does CVE-2022-28397 allow attackers to execute arbitrary code?
Attackers can execute arbitrary code by exploiting the arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 with a crafted file.
How can I mitigate the risk of CVE-2022-28397?
To mitigate the risk of CVE-2022-28397, ensure that only trusted users are allowed to upload and publish files in Ghost CMS v4.42.0.
Where can I find more information about CVE-2022-28397?
More information about CVE-2022-28397 can be found in Ghost's security documentation, available at https://ghost.org/docs/security/#privilege-escalation-attacks.