CVE-2021-39192 MEDIUM

CVE-2021-39192: Privilege escalation: all users can access Admin-level API keys

Vendor Tryghost
Product Ghost
Weakness CWE-200 · Info exposure
Published September 3, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround.

Key dates

02Disclosure timeline

September 3, 2021 CVE published
August 4, 2024 Record updated