How severe is CVE-2021-39192?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.2 out of 10.

What type of vulnerability is CVE-2021-39192?

This is classified as CWE-200, which is a common weakness in software security.

CVE-2021-39192 - HIGH Severity | CVSS 7.2

Vulnerability Description

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround.

Related Vulnerabilities

CVE-2016-7561

HIGH

CVSS:7.2(High)

Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.

CWE-2002016

CVE-2017-7738

HIGH

CVSS:7.2(High)

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privileges to view the current SSL VPN web porta...

CWE-2002017

CVE-2018-1000633

HIGH

CVSS:7.2(High)

The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's p...

CWE-2002018

CVE-2018-1074

HIGH

CVSS:7.2(High)

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A H...

CWE-2002018

CVE-2018-13378

HIGH

CVSS:7.2(High)

An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.

CWE-2002018

CVE-2019-11407

HIGH

CVSS:7.2(High)

app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated adm...

CWE-2002019