CVE-2022-47196

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-47196
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-47196.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-47196
Aliases
Published
2023-01-19T18:15:14.380Z
Modified
2026-04-10T04:52:51.038088Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the codeinjection_head for a post.

References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d153b40c48dfa8c053c02262b12f5d5462a87872
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.9.4"
        }
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.2.0
0.2.0-final
0.2.1
0.3.0
0.4.0
0.4.0-pre
0.4.0-pre2
0.4.0-pre3
0.4.2
0.4.2-rc1
0.4.2-rc2
0.5.0
0.5.0-rc1
0.5.0-rc2
0.5.0-rc3
0.5.0-rc4
0.5.10
0.5.2
0.5.2-rc1
0.5.2-rc2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.9.0
0.9.0-beta.1
0.9.0-beta.2
1.*
1.0.0
1.0.0-alpha.1
1.0.0-alpha.10
1.0.0-alpha.11
1.0.0-alpha.13
1.0.0-alpha.14
1.0.0-alpha.15
1.0.0-alpha.16
1.0.0-alpha.17
1.0.0-alpha.18
1.0.0-alpha.19
1.0.0-alpha.2
1.0.0-alpha.20
1.0.0-alpha.21
1.0.0-alpha.3
1.0.0-alpha.4
1.0.0-alpha.5
1.0.0-alpha.6
1.0.0-alpha.7
1.0.0-alpha.8
1.0.0-alpha.9
1.0.0-beta.1
1.0.0-beta.2
1.0.0-rc.1
1.0.1
1.0.2
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.1
1.13.0
1.14.0
1.14.1
1.15.0
1.15.1
1.16.0
1.16.1
1.16.2
1.17.0
1.17.1
1.17.2
1.17.3
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.2.0
1.20.0
1.20.1
1.20.2
1.20.3
1.21.0
1.21.1
1.21.2
1.21.3
1.21.4
1.21.5
1.21.6
1.21.7
1.22.0
1.22.1
1.22.2
1.22.3
1.22.4
1.22.5
1.22.6
1.22.7
1.22.8
1.23.0
1.23.1
1.24.0
1.24.1
1.24.2
1.24.3
1.24.4
1.24.5
1.24.6
1.24.7
1.24.8
1.24.9
1.25.0
1.25.1
1.25.2
1.25.3
1.25.4
1.25.5
1.3.0
1.4.0
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.10.0
2.10.1
2.10.2
2.11.0
2.11.1
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.15.0
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.17.0
2.17.1
2.17.2
2.18.0
2.18.1
2.18.2
2.18.3
2.19.0
2.19.1
2.19.2
2.19.3
2.19.4
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.20.0
2.20.1
2.21.0
2.21.1
2.22.0
2.22.1
2.22.2
2.22.3
2.23.0
2.23.1
2.23.2
2.23.3
2.23.4
2.24.0
2.25.0
2.25.1
2.25.2
2.25.3
2.25.4
2.25.5
2.25.6
2.25.7
2.25.8
2.25.9
2.26.0
2.27.0
2.28.0
2.28.1
2.29.0
2.29.1
2.3.0
2.30.0
2.30.1
2.30.2
2.31.0
2.31.1
2.32.0
2.33.0
2.34.0
2.35.0
2.36.0
2.37.0
2.4.0
2.5.0
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
2.9.1
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.10.0
3.11.0
3.12.0
3.12.1
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.17.0
3.17.1
3.18.0
3.18.1
3.19.0
3.19.1
3.19.2
3.2.0
3.20.0
3.20.1
3.20.2
3.20.3
3.21.0
3.22.0
3.22.1
3.23.0
3.23.1
3.24.0
3.25.0
3.26.0
3.26.1
3.27.0
3.28.0
3.29.0
3.29.1
3.3.0
3.30.0
3.30.1
3.31.0
3.31.1
3.31.2
3.31.3
3.32.0
3.32.1
3.33.0
3.34.0
3.35.0
3.35.1
3.35.2
3.35.3
3.35.4
3.35.5
3.36.0
3.37.0
3.37.1
3.38.0
3.38.1
3.39.0
3.4.0
3.40.0
3.40.1
3.40.2
3.40.3
3.40.4
3.40.5
3.41.0
3.41.1
3.41.2
3.41.3
3.5.0
3.5.1
3.5.2
3.6.0
3.7.0
3.8.0
3.9.0
4.*
4.0.0-alpha.0
4.0.0-alpha.1
4.0.0-alpha.2
4.0.0-alpha.3
4.0.0-rc.0
Other
backbone-admin
fancyFirstChar
v4.*
v4.0.0
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.1
v4.1.0
v4.1.1
v4.1.2
v4.10.0
v4.15.0
v4.16.0
v4.17.0
v4.18.0
v4.19.0
v4.2.0
v4.20.0
v4.20.1
v4.21.0
v4.22.0
v4.22.2
v4.22.4
v4.24.0
v4.25.1
v4.26.0
v4.27.0
v4.27.1
v4.27.2
v4.28.0
v4.29.0
v4.3.0
v4.30.0
v4.30.1
v4.31.0
v4.32.0
v4.32.1
v4.32.3
v4.33.0
v4.34.0
v4.35.0
v4.36.0
v4.36.2
v4.37.0
v4.38.0
v4.39.0
v4.4.0
v4.40.0
v4.41.0
v4.41.3
v4.42.0
v4.43.0
v4.44.0
v4.45.0
v4.46.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.8.0
v4.9.0
v4.9.1
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.1.1
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.3.0
v5.4.0
v5.5.0
v5.6.0
v5.7.0
v5.7.1
v5.8.0
v5.8.1
v5.8.2
v5.8.3
v5.9.0
v5.9.1
v5.9.2
v5.9.3
v5.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-47196.json"