CVE-2022-47194

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-47194
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-47194.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-47194
Aliases
Published
2023-01-19T17:02:10.446Z
Modified
2026-07-15T01:48:53.981024199Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the twitter field for a user.

Database specific 
{
    "cwe_ids": [
        "CWE-453"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/47xxx/CVE-2022-47194.json",
    "cna_assigner": "talos",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.9.4"
                },
                {
                    "last_affected": "5.9.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
d153b40c48dfa8c053c02262b12f5d5462a87872
Last affected
d153b40c48dfa8c053c02262b12f5d5462a87872
Database specific 
{
    "cpe": "cpe:2.3:a:ghost:ghost:5.9.4:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "5.9.4"
        },
        {
            "last_affected": "5.9.4"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

5.*
5.9.4
v5.*
v5.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-47194.json"