Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects the Ghost content management system versions from 6.19.4 until 6.21.1. It arises because the system does not properly validate the Content-Type header supplied by clients when uploading files through the Admin API. As a result, attackers can upload files with a maliciously chosen content type that are then served from the site using S3 or GCS storage backends.

If the installation serves uploaded files from the same origin as the site, this flaw can be exploited to perform stored cross-site scripting (XSS) attacks against site visitors or staff by delivering malicious scripts through these uploaded files.

The vulnerability was fixed in version 6.21.1 of Ghost.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to stored cross-site scripting (XSS) attacks if exploited. An attacker could upload a file with a malicious content type that, when served from the same origin as the site, executes harmful scripts in the browsers of site visitors or staff.

Such attacks can compromise user data, hijack user sessions, deface the website, or perform other malicious actions within the context of the affected site.

The overall impact is a moderate security risk, reflected by a CVSS base score of 5.4, indicating that the vulnerability requires low attack complexity but some privileges and user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Ghost to version 6.21.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0