CyberRota Analysis
AI-GeneratedGhost, a Node.js content management system, is vulnerable to session fixation attacks due to the failure to invalidate existing sessions upon login from versions 2.2.0 to 6.54.1. Exploiting this vulnerability requires an additional weakness on the same domain, potentially allowing attackers to hijack user sessions. Organizations using affected versions should prioritize upgrading to version 6.54.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.