Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
References
Configurations
History
21 Nov 2024, 08:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f - Patch | |
| References | () https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1 - Release Notes |
11 May 2023, 14:19
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:* | |
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f - Patch | |
| References | (MISC) https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1 - Release Notes |
05 May 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-05 05:15
Updated : 2025-01-29 17:15
NVD link : CVE-2023-32235
Mitre link : CVE-2023-32235
CVE.ORG link : CVE-2023-32235
JSON object : View
Products Affected
ghost
- ghost
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')