CVE-2021-39192 : Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround.

Published 2021-09-03 15:15:09

Updated 2021-09-10 19:02:46

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Gain privilegeInformation leak

Products affected by CVE-2021-39192

Ghost » Ghost » For Node.js
Versions from including (>=) 4.0.0 and before (<) 4.10.0
cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-39192

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 47 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-39192

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	1.2	5.2	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-39192

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security-advisories@github.com (Secondary)
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-39192

https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c

Privilege escalation: all users can access Admin-level API keys · Advisory · TryGhost/Ghost · GitHub
Third Party Advisory
https://github.com/TryGhost/Ghost/releases/tag/v4.10.0

Release 4.10.0 · TryGhost/Ghost · GitHub
Release Notes;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-39192

Products affected by CVE-2021-39192

Exploit prediction scoring system (EPSS) score for CVE-2021-39192

CVSS scores for CVE-2021-39192

CWE ids for CVE-2021-39192

References for CVE-2021-39192