CVE-2024-43409 Ghost's improper authentication allows access to member information and actions
Attackers can bypass authentication to access member information and perform member-only actions in Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43409?
CVE-2024-43409 is a medium-severity authentication bypass vulnerability in TryGhost Ghost, published on 20 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.
Which versions are affected by CVE-2024-43409?
5 open source packages ship an affected version, including @tryghost/portal and ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tryghost/portal npm | From 1.22.2 | 2.39.0 |
@tryghost/portal npm | From 1.22.2 | 2.39.0 |
ghost Bitnami | From 4.46.0 | 5.89.5 |
ghost npm | From 4.46.0 | 5.89.5 |
ghost npm | From 4.46.0 | 5.89.5 |
Products include Ghost Ghost.
How do I fix CVE-2024-43409?
Upgrade @tryghost/portal to 2.39.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-43409 being exploited?
There is no known exploitation of CVE-2024-43409 in the wild and no public exploit code.
Other vulnerabilities in TryGhost Ghost
Sources
Also known as BIT-ghost-2024-43409, GHSA-78x2-cwp9-5j42.