Ghost allows CSV Injection during member CSV export

GHSA ID

GHSA-xgwh-cgv9-783v

CVE ID

CVE-2024-34448

Severity

high

Published

2024-05-22T18:30:40Z

Updated

2024-05-22T19:42:50Z

CVSS

8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3

8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

CWEs

• CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-34448 ↗
• https://github.com/phulelouch/CVEs/blob/main/CVE-2024-34448.md ↗
• https://github.com/TryGhost/Ghost/commit/de668e7950a019a204b2df0c84596ea0fa32cce6 ↗
• https://github.com/advisories/GHSA-xgwh-cgv9-783v ↗