GHSA-7mpp-r37j-x5wh: Medium severity npm/ghost vulnerability
Impact
Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted.
Vulnerable versions
This vulnerability is present in Ghost from v2.2.0 to v6.54.0.
Patches
v6.54.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks meifukun for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.54.1 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.54.1
Event History
Frequently Asked Questions
What is the severity of GHSA-7mpp-r37j-x5wh?
The severity of GHSA-7mpp-r37j-x5wh is rated medium with a score of 6.7.
What can exploitation of GHSA-7mpp-r37j-x5wh lead to?
Exploitation of GHSA-7mpp-r37j-x5wh can lead to session fixation attacks if combined with another vulnerability on the same domain.
How do I fix GHSA-7mpp-r37j-x5wh?
To fix GHSA-7mpp-r37j-x5wh, update to a patched version of Ghost that invalidates existing sessions on login.
Which versions of Ghost are affected by GHSA-7mpp-r37j-x5wh?
GHSA-7mpp-r37j-x5wh affects vulnerable versions of Ghost where session invalidation on login is not implemented.
What are potential mitigations for GHSA-7mpp-r37j-x5wh?
Potential mitigations for GHSA-7mpp-r37j-x5wh include ensuring that proper session management practices are in place along with applying the latest security updates for Ghost.