This security bulletin contains one low risk vulnerability.
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper API validation for nested objects. A remote user can bypass implemented security restrictions and make changes to newsletter settings.Mitigation
Install updates from vendor's website.Vulnerable software versions
Ghost: 4.46.0 - 5.22.6Fixed software versions
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?