CyberRota Analysis
AI-GeneratedA vulnerability exists in the Ghost Node.js content management system that allows staff-level users to ascertain the relative ordering of other staff users' hashed passwords, although it does not directly expose the hashes or facilitate password recovery. While the severity is rated low, organizations using versions 0.7.2 through 6.63.9 should prioritize upgrading to version 6.64.0 to mitigate any potential risks associated with user privacy and password management.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.