CVE-2022-47194: XSS
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the twitter field for a user.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Ghost Foundation vulnerability?
The vulnerability ID for this Ghost Foundation vulnerability is CVE-2022-47194.
What is the severity of CVE-2022-47194?
The severity of CVE-2022-47194 is critical.
What is the affected software for CVE-2022-47194?
The affected software for CVE-2022-47194 is Ghost Foundation Ghost 5.9.4.
What is the issue in the Post Creation functionality of Ghost Foundation Ghost 5.9.4?
The issue in the Post Creation functionality of Ghost Foundation Ghost 5.9.4 is an insecure default vulnerability that allows non-administrator users to inject arbitrary Javascript in posts, leading to privilege escalation via XSS.
How can I trigger the vulnerability in Ghost Foundation Ghost 5.9.4?
To trigger the vulnerability in Ghost Foundation Ghost 5.9.4, an attacker needs to inject arbitrary JavaScript in posts.