CVE-2022-47197: XSS
First published: Thu Jan 19 2023(Updated: )
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ghost Ghost Node.js | =5.9.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2022-47197?
The severity of CVE-2022-47197 is critical.
How does CVE-2022-47197 impact Ghost Foundation Ghost 5.9.4?
CVE-2022-47197 allows non-administrator users to inject arbitrary Javascript in posts, resulting in privilege escalation to administrator via XSS.
How can I trigger CVE-2022-47197?
CVE-2022-47197 can be triggered by injecting arbitrary Javascript in posts on default installations of Ghost 5.9.4.
What is the Common Weakness Enumeration (CWE) of CVE-2022-47197?
The CWE of CVE-2022-47197 is CWE-79 (Cross-Site Scripting) and CWE-453 (Insecure Default Variable Initialization).
Are there any references or further information about CVE-2022-47197?
Yes, you can find more information about CVE-2022-47197 at the following link: [TALOS-2022-1686](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686).
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ghost
- canonical/ghost ghost node.js
- version/ghost ghost node.js/5.9.4