Description
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
TryGhost Ghost
Default version status: unaffected
3.10.0 to < 6.34.0affected6.34.0unaffected
pkg:npm/ghost