CVE-2023-31133
published 2023-05-08CVE-2023-31133: Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to…
PriorityP262high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
45.71%
98.6th percentile
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.
Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | ghost | < 5.46.1 | 5.46.1 |
| ghost | ghost | >= 0 < 5.46.1 | 5.46.1 |
| tryghost | ghost | < 5.46.1 | 5.46.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Ghost vulnerable to information disclosure of private API fields
osv·2023-05-03
CVE-2023-31133 [HIGH] Ghost vulnerable to information disclosure of private API fields
Ghost vulnerable to information disclosure of private API fields
### Impact
Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.
Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.
Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.
### Patches
v5.46.1 contains a fix for this issue.
### Workarounds
Add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
### For more information
If you have any questions or comments about this advisory:
* Email us a
GHSA
Ghost vulnerable to information disclosure of private API fields
ghsa·2023-05-03
CVE-2023-31133 [HIGH] CWE-200 Ghost vulnerable to information disclosure of private API fields
Ghost vulnerable to information disclosure of private API fields
### Impact
Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.
Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.
Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.
### Patches
v5.46.1 contains a fix for this issue.
### Workarounds
Add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
### For more information
If you have any questions or comments about this advisory:
* Email us a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/TryGhost/Ghost/commit/b3caf16005289cc9909488391b4a26f3f4a66a90https://github.com/TryGhost/Ghost/releases/tag/v5.46.1https://github.com/TryGhost/Ghost/security/advisories/GHSA-r97q-ghch-82j9https://github.com/TryGhost/Ghost/commit/b3caf16005289cc9909488391b4a26f3f4a66a90https://github.com/TryGhost/Ghost/releases/tag/v5.46.1https://github.com/TryGhost/Ghost/security/advisories/GHSA-r97q-ghch-82j9
2023-05-08
Published