BIT-ghost-2026-29784
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/ghost/BIT-ghost-2026-29784.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-ghost-2026-29784
- Aliases
-
- CVE-2026-29784
- GHSA-9m84-wc28-w895
- Published
- 2026-03-10T08:40:17.691Z
- Modified
- 2026-03-10T09:26:17.416781Z
- Summary
- Ghost: Incomplete CSRF protections around OTC use
- Details
-
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.
- Database specific
{ "severity": "High", "cpes": [ "cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*" ] }- References
Affected packages
Bitnami / ghost
Package
- Name
- ghost
- Purl
- pkg:bitnami/ghost
Severity
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator