CVE-2022-47195: XSS
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the facebook field for a user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-47195?
CVE-2022-47195 is considered a high severity vulnerability due to its potential for privilege escalation via arbitrary Javascript injection.
How do I fix CVE-2022-47195?
To fix CVE-2022-47195, ensure you upgrade to the latest version of Ghost that addresses this security issue.
Who is affected by CVE-2022-47195?
Any installation of Ghost version 5.9.4 with default settings is vulnerable to CVE-2022-47195.
What type of vulnerability is CVE-2022-47195?
CVE-2022-47195 is an insecure default vulnerability that allows XSS attacks.
What can attackers do with CVE-2022-47195?
Attackers can inject arbitrary Javascript into posts, potentially escalating their privileges to that of an administrator.