CyberRota Analysis
AI-GeneratedGhost versions prior to 6.57.1 have a session handling vulnerability that enables authenticated staff users to impersonate any other staff member by using only their password, circumventing two-factor authentication. This flaw allows attackers with valid credentials to gain unauthorized access to administrative functions, posing a significant risk to organizational security. Organizations using affected versions should prioritize remediation to protect against potential insider threats and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to impersonate other staff members and gain unauthorized access to administrative functions.