This security bulletin contains one low risk vulnerability.
Exploit availability: NoDescription
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper API validation for nested objects. A remote user can bypass implemented security restrictions and make changes to newsletter settings.Mitigation
Install updates from vendor's website.Vulnerable software versions
Ghost: 5.0.0 - 5.22.6, 4.46.0 - 4.48.7
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?