Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendors position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ghost | Ghost | * | 5.85.1 (including) |
Attackers may be able to bypass weak authentication faster and/or with less effort than expected.