CVE-2022-41697 Information disclosure in Ghost

What is CVE-2022-41697?

CVE-2022-41697 is a medium-severity vulnerability in Ghost, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

Weakness: CWE-204

Which versions are affected by CVE-2022-41697?

1 open source package ship an affected version, including ghost. It affects 1 product.

Products include Ghost Ghost.

How do I fix CVE-2022-41697?

Upgrade ghost to 5.9.5 or later.

Is CVE-2022-41697 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41697 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Ghost

• CVE-2022-27139 Arbitrary file upload in Ghost Critical 9.8
• CVE-2022-28397 Arbitrary file upload in Ghost Critical 9.8
• CVE-2022-41654 ghost vulnerable to unauthorized newsletter modification via improper access controls Critical 9.6
• CVE-2026-26980 Ghost has a SQL Injection in its Content API Critical 9.4
• CVE-2024-34451 Security feature bypass in n/a Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-ghost-2022-41697, GHSA-65hg-2rxp-4w4r.