CVE-2022-47197: XSS
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the codeinjectionfoot for a post.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-47197?
The severity of CVE-2022-47197 is critical.
How does CVE-2022-47197 impact Ghost Foundation Ghost 5.9.4?
CVE-2022-47197 allows non-administrator users to inject arbitrary Javascript in posts, resulting in privilege escalation to administrator via XSS.
How can I trigger CVE-2022-47197?
CVE-2022-47197 can be triggered by injecting arbitrary Javascript in posts on default installations of Ghost 5.9.4.
What is the Common Weakness Enumeration (CWE) of CVE-2022-47197?
The CWE of CVE-2022-47197 is CWE-79 (Cross-Site Scripting) and CWE-453 (Insecure Default Variable Initialization).
Are there any references or further information about CVE-2022-47197?
Yes, you can find more information about CVE-2022-47197 at the following link: [TALOS-2022-1686](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1686).