Description
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TryGhost | Ghost | 5.19.0 – < 6.57.1 | 6.57.1 |
References
- GitHub Security Advisory (GHSA-mf3j-vxq2-vmc4) vendor-advisory
- VulnCheck Advisory: Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery third-party-advisory