CyberRota Analysis
AI-GeneratedThe Ghost Node.js content management system prior to version 6.54.1 is vulnerable, allowing staff-level users to leak hashed passwords of other staff members via the Ghost Admin API. This could potentially enable an offline password-guessing attack, leading to account takeover, although Device Verification mitigates direct login attempts with recovered passwords. Organizations using Ghost should prioritize upgrading to version 6.54.1 to safeguard against this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.