Description
Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control donation checkout metadata and obtain full paid gift memberships for a minimal payment without exposing customer or member data or stealing money from a site or its members. This issue is fixed in version 6.44.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
TryGhost Ghost
>= 6.27.0, < 6.44.0affected
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf ↗
- https://github.com/TryGhost/Ghost/pull/28351 ↗
- https://github.com/TryGhost/Ghost/pull/28352 ↗
- https://github.com/TryGhost/Ghost/commit/cab716cd015ac04b7ee50c7a405478d97bc7b1e0 ↗
- https://github.com/TryGhost/Ghost/commit/ee7b991b466a7849c70f9d1caed8e491ee4113c6 ↗