Threats tagged 'ghsa-x5mm-wm4g-j5xv'

Ghost, a Node.js content management system, has a server-side request forgery (SSRF) vulnerability affecting versions from 6.26.0 up to but not including 6.54.1. This flaw allowed unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to internal hosts on the Ghost server's network. The vulnerability does not expose response data to the attacker. The issue is fixed in version 6.54.1.