GitHub Advisoryadvisory · npm

GHSA-q4h8-7qff-gh6c Server-side request forgery in Ghost CMS

MEDIUM Published 2021-05-06 Modified 2021-05-04 Official page ↗
Aliases
CVE-2020-8134
Ecosystem
npm
Packages
ghost
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-918
Reviewed
2021-05-04

Affected packages

• npm ghost: < 3.10.0 → fixed in 3.10.0

Description

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.

Related

Alias · CVE (1)

  • CVE-2020-8134 Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References