Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2022-28397 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://ghost.org/customers/
• https://ghost.org/docs/security/#privilege-escalation-attacks

Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2022-28397 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://ghost.org/customers/
• https://ghost.org/docs/security/#privilege-escalation-attacks