Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Vulnerable versions This vulnerability is present in Ghost versions: - v5.43.0 to v5.120.4 - v6.0.0 to v6.14.0 As well as in Portal versions: - v2.29.1 to v2.51.4 - v2.52.0 to v2.57.0 Patches Ghost automatically loads the latest patch of the members Portal component via CDN. Therefore: - For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability (loads Portal v2.51.5, which contains the patch) - For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability (loads Portal v2.57.1, which contains the patch) For Ghost installations using a customised or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version. References Ghost thanks Younes Belalia for discovering and disclosing this…
Recommended action: Upgrade to 2.57.1 or 2.51.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. Vulnerable versions This security vulnerability is present in Ghost v4.46.0-v5.89.5. Ghost(Pro) customers are automatically updated to fixed versions ahead of disclosure. If you're a self-hoster, please follow our update instructions. Patches v5.89.5 contains a fix for this issue. Workarounds Disable site membership in Ghost settings. For more information If you have any questions or comments about this advisory: Email us at security@ghost.org
Recommended action: Upgrade to 2.39.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.