We found results for “”
WS-2015-0079
Good to know:
Date: September 25, 2015
In Ghost headless CMS, versions 0.5.0-rc1 through 0.7.0 are vulnerable to improper access control. A user with publish privileges can override the published_by field and alter it to his username, thus affecting integrity.
Language: JS
Severity Score
Severity Score
Weakness Type (CWE)
External Control of Assumed-Immutable Web Parameter
CWE-472Top Fix
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | LOW |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | LOW |
Availability (A): | NONE |