BIT-ghost-2022-28397

vendorUSosv

Advisory ansehen veröffentlicht 2024-03-06Lizenz: per source

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-28397US	critical9.8	3.50% (89th)	—	2022-04-12
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

http://ghost.comWEB
https://ghost.org/customers/WEB
https://ghost.org/docs/security/#privilege-escalation-attacksWEB
https://github.com/TryGhost/GhostADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-28397WEB
https://trends.builtwith.com/cms/GhostWEB
https://youtu.be/PncfBetPk2gADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan