SB20260814120 - Multiple vulnerabilities in Ghost

Description

This security bulletin contains information about 3 vulnerabilities.

1) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass two-factor authentication and log in as another staff user.

The vulnerability exists due to insufficient session expiration in session handling when switching users. A remote user can authenticate as a staff user and then log in as another staff user using only the password to bypass two-factor authentication and log in as another staff user.

The issue affects staff user account transitions between users.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose member data.

The vulnerability exists due to incorrect authorization in the Ghost Admin Feedback endpoint when handling requests. A remote user can access the endpoint to disclose member data.

3) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to submit post feedback on behalf of a logged-in member.

The vulnerability exists due to cross-site request forgery in post feedback when navigating to a crafted URL. A remote attacker can send a crafted link to cause unauthorized feedback submission.

User interaction is required, and only logged-in members can be affected.

Remediation

Install update from vendor's website.

References

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-q55r-w7fh-rmh6
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-vm82-r49m-224q
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-mf3j-vxq2-vmc4