CVE-2021-29484 json
DOM XSS in Theme Preview
published 2021-04-29 5 y ago modified 2026-09-08 2 mo ago also BIT-ghost-2021-29484 , EUVD-2021-0804 , GHSA-9fgx-q25h-jxrg
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.9%
- EPSS 7.9% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site. The issue has been fixed in 4.3.3, all 4.x sites should upgrade as soon as possible. As the endpoint is unused, the patch simply removes it. As a workaround blocking access to /ghost/preview can also mitigate the issue.
Patch / fix
Exploit prediction
7.94% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Ghost CMS <=4.32 - Cross-Site Scripting nuclei detection template
- blog.sonarsource.com https://blog.sonarsource.com/ghost-admin-takeover referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ghost | >=4.0.0, <4.3.3 |
4.3.3 |
| bitnami | ghost | >=4.0.0, <4.3.3 |
4.3.3 |
Affected products
- TryGhost Ghost
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/TryGhost/Ghost/commit/14b3431de12e674a0bd562e9230e2891b6903ae2
web
-
blog.sonarsource.com
/ghost-admin-takeover
web, exploit, third-party-advisory, advisory
-
forum.ghost.org
/t/critical-security-update-available-for-ghost-4-x/22290
web, vendor-advisory, advisory
-
github.com
/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg
web, mitigation, third-party-advisory, advisory
-
npmjs.com
/package/ghost
web, product, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-29484
advisory, web
-
github.com
/TryGhost/Ghost
package
-
security.netapp.com
/advisory/ntap-20210618-0006
web
Sources
- CVE List CVE-2021-29484
- GitHub Advisory GHSA-9fgx-q25h-jxrg
- NVD CVE-2021-29484
- OSV BIT-ghost-2021-29484
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.