CVE-2023-32235
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 39%
from disclosure to weapon65 days
Published on NVDMay 5
1st PoC+65d
VulnCheck+213d
exploitation probability
39%top 2% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/apublic PoCs found — 3
exploitdbwww.exploit-db.com/exploits/52408unverifiedgithubgithub.com/AXRoux/Ghost-Path-Traversal-CVE-2023-32235-★ 4vulncheckvulncheck.com/xdb/90d0eb0be271unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.