CVE-2024-43409 json
Ghost's improper authentication allows access to member information and actions
published 2024-08-20 2 y ago modified 2026-09-08 2 mo ago also BIT-ghost-2024-43409 , EUVD-2024-2525 , GHSA-78x2-cwp9-5j42
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
Patch / fix
- npm ghost 5.89.5
- npm @tryghost/portal 2.39.0
- bitnami ghost 5.89.5
- ghost ghost 5.89.5
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ghost | >=4.46.0, <5.89.5 |
5.89.5 |
| npm | @tryghost/portal | >=1.22.2, <2.39.0 |
2.39.0 |
| bitnami | ghost | >=4.46.0, <5.89.5 |
5.89.5 |
Affected products
- TryGhost Ghost
- ghost ghost
Classification
References
-
github.com
/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db
web, patch
-
github.com
/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-43409
advisory, web
-
github.com
/TryGhost/Ghost
package
Sources
- CVE List CVE-2024-43409
- GitHub Advisory GHSA-78x2-cwp9-5j42
- NVD CVE-2024-43409
- OSV BIT-ghost-2024-43409
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.