CVE-2023-31133: Ghost vulnerable to disclosure of private API fields
First published: Wed May 03 2023(Updated: )
### Impact Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below. ### Patches v5.46.1 contains a fix for this issue. ### Workarounds Add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`. ### For more information If you have any questions or comments about this advisory: * Email us at [security@ghost.org](mailto:security@ghost.org)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/ghost | <5.46.1 | 5.46.1 |
| Ghost Ghost Node.js | <5.46.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/TryGhost/Ghost/releases/tag/v5.46.1
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-r97q-ghch-82j9
- https://github.com/TryGhost/Ghost/commit/b3caf16005289cc9909488391b4a26f3f4a66a90
- https://nvd.nist.gov/vuln/detail/CVE-2023-31133
- https://github.com/advisories/GHSA-r97q-ghch-82j9 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-31133?
CVE-2023-31133 is considered to have a medium severity due to its potential for exposing private fields via brute force attacks.
How do I fix CVE-2023-31133?
To fix CVE-2023-31133, you should upgrade to Ghost version 5.46.1 or later.
What systems are affected by CVE-2023-31133?
CVE-2023-31133 affects all versions of Ghost prior to version 5.46.1.
Is CVE-2023-31133 being exploited in the wild?
There is currently no evidence that CVE-2023-31133 has been exploited in the wild prior to the release of the patch.
What specific vulnerability does CVE-2023-31133 address?
CVE-2023-31133 addresses a lack of validation when filtering on the public API, which could allow brute force attacks to reveal private fields.
- collector/nvd-latest
- collector/github-advisory-latest
- alias/GHSA-r97q-ghch-82j9
- alias/CVE-2023-31133
- collector/github-advisory
- agent/author
- agent/type
- agent/first-publish-date
- agent/title
- agent/remedy
- agent/references
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/npm
- vendor/ghost
- canonical/ghost ghost node.js