Description

The Ghost CMS is vulnerable to a path traversal vulnerability. An unauthenticated attacker can read arbitrary files within the active theme's folder.

Remediation

Upgrade to the latest version of Ghost CMS

References

Path Traversal in Ghost

Related Vulnerabilities

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-25700)

Oracle HTTP Server Other Vulnerability (CVE-2002-0656)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-6420)

Plupload Cross-site Scripting (XSS) Vulnerability (CVE-2016-4566)

WebLogic CVE-2020-14637 Vulnerability (CVE-2020-14637)

Severity

High

Classification

CVE-2023-32235 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Directory Traversal Known Vulnerabilities