Description (CNA)
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TryGhost / Ghost | affected 0.5.0 before 6.23.0 |
CWE
CWE-362
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-vf9h-87xm-g767
- https://www.vulncheck.com/advisories/ghost-0.5.0-before-6.23.0-multiple-account-creation-via-invite-token
ADP enrichment
No English description supplied.
No references supplied.