# CVE-2022-41697: Ghost Foundation - Information Disclosure

> Live exploitation tracking for CVE-2022-41697 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-41697

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Ghost Foundation Ghost
- **Weaknesses:** CWE-204 (Observable Response Discrepancy)
- **Tags:** cms

## Description

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

## CrowdSec analysis

[CVE-2022-41697](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-41697) is a user enumeration vulnerability affecting the login functionality of Ghost. Attackers can leverage specially crafted HTTP requests to disclose sensitive information regarding user accounts.

CrowdSec has been tracking this vulnerability and its exploits since 27th of December 2022.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-41697 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Typical exploitation patterns involve probing the authentication endpoint to harvest information about valid usernames.

## Timeline

- 2022-12-23: CVE Published. CVE-2022-41697 is published to NVD.
- 2022-12-27: Rule Released. CrowdSec releases a rule to detect CVE-2022-41697 exploitation attempts against the CrowdSec Network.
- 2025-03-30: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-41697 for the first time.

## References

- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1625

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-41697) follows observed exploitation activity for CVE-2022-41697. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.