CVE-2024-23725

Summary

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/TryGhost/Ghost/pull/17190
• https://github.com/TryGhost/Ghost/releases/tag/v5.76.0

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/TryGhost/Ghost/pull/17190
• https://github.com/TryGhost/Ghost/releases/tag/v5.76.0

• ←Previous
• Next→