CVE-2022-41654criticalCWE-284

CVE-2022-41654: critical vulnerability in Ghost

Published · Updated

Follow this CVE+ Monitor Ghost+ Monitor ghost

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 19%
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Ghost Foundation · Ghost
Related CVEs — Ghost

In the same product, most dangerous first.

CVE-2022-41697MEDIUMCVE-2022-41697EPSS 20.0%CVE-2022-47197CRITICALCVE-2022-47197EPSS 1.0%CVE-2022-47194CRITICALCVE-2022-47194EPSS 0.8%CVE-2024-34559HIGHWordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.7%CVE-2022-47196CRITICALCVE-2022-47196EPSS 0.7%CVE-2022-47195CRITICALCVE-2022-47195EPSS 0.7%