CVE-2020-8134
Quick assessment
Affected
n/a Ghost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghost CMS是新加坡Ghost基金会的一套使用JavaScript编写的开源无头内容管理系统（CMS）。 Ghost CMS 3.10.0之前版本中存在代码问题漏洞。攻击者可利用该漏洞扫描本地或外部网络或与内部系统进行交互。
Possible ATT&CK Techniques 3 AI
T1046 · Network Service Discovery T1105 · Ingress Tool Transfer T1590 · Gather Victim Network Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-8134
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Ghost CMS 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ghost CMS是新加坡Ghost基金会的一套使用JavaScript编写的开源无头内容管理系统（CMS）。 Ghost CMS 3.10.0之前版本中存在代码问题漏洞。攻击者可利用该漏洞扫描本地或外部网络或与内部系统进行交互。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Ghost | Fixed Version: 3.10.0 | - |
|
II. Public POCs for CVE-2020-8134
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-8134
请登录查看更多情报信息。
Other References for CVE-2020-8134 (1)
-
https://hackerone.com/reports/793704 x_refsource_MISC
Same Patch Batch · n/a · 2020-03-20 · 56 CVEs total
| CVE-2020-10682 | CMS Made Simple Filemanager 代码问题漏洞 | |
| CVE-2018-20334 | ASUS ASUSWRT 操作系统命令注入漏洞 | |
| CVE-2019-19025 | Cloud Native Computing Foundation Harbor 跨站请求伪造漏洞 | |
| CVE-2018-20333 | ASUSWRT 信息泄露漏洞 | |
| CVE-2019-18782 | SalesAgility SuiteCRM 安全漏洞 | |
| CVE-2019-18785 | SalesAgility SuiteCRM 安全漏洞 | |
| CVE-2018-20335 | ASUSWRT 输入验证错误漏洞 | |
| CVE-2019-19486 | Centreon 路径遍历漏洞 | |
| CVE-2019-19484 | Centreon 输入验证错误漏洞 | |
| CVE-2020-10681 | CMS Made Simple 跨站脚本漏洞 | |
| CVE-2019-19487 | Centreon 操作系统命令注入漏洞 | |
| CVE-2020-10597 | Delta Electronics Industrial Automation DOPSoft 缓冲区错误漏洞 | |
| CVE-2020-1862 | Huawei CampusInsight和ManageOne 资源管理错误漏洞 | |
| CVE-2020-1795 | Huawei Mate 20和Mate 30 Pro 安全漏洞 | |
| CVE-2020-1878 | Huawei OxfordS-AN00A 授权问题漏洞 | |
| CVE-2020-1796 | Huawei Mate 20和Mate 30 Pro 安全漏洞 | |
| CVE-2020-1793 | Huawei Mate 20和Mate 30 Pro 授权问题漏洞 | |
| CVE-2020-1864 | Huawei Secospace AntiDDoS8000 授权问题漏洞 | |
| CVE-2020-1794 | Huawei Mate 20和Mate 30 Pro 授权问题漏洞 | |
| CVE-2020-1879 | 多款Huawei产品安全漏洞 |
Showing top 20 of 56 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Ghost
-
CVE-2026-72596
Ghost Foundation Ghost - Broken Access Control -
CVE-2026-70596
Ghost: Cross-Site Scripting in Feature Image Captions -
CVE-2026-70595
Ghost: Server-Side Request Forgery Mitigation Issue -
CVE-2026-70594
Ghost: Session Fixation in Ghost Admin -
CVE-2026-70593
Ghost: Theme Upload Path Traversal
Same vendor: n/a
-
CVE-2026-78187
Piwigo Public Authentication cross site scripting -
CVE-2026-78186
Open5GS HSS hss-cx-path.c assertion -
CVE-2026-78178
jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollu -
CVE-2026-78158
Open5GS AMF UEContextReleaseRequest Path improper authorizat -
CVE-2026-78157
Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-b
Same weakness: CWE-918
-
CVE-2026-78682
NLTK before 3.10.3 SSRF Protection Bypass via Proxy -
CVE-2026-34964
Adminer before 5.5.0 SSRF via PDO DSN Injection -
CVE-2026-77310
jackson-databind: Eager DNS resolution (SSRF) still present -
CVE-2026-76838
Hi.Events before 1.11.1-beta Server-Side Request Forgery via -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage
V. Comments for CVE-2020-8134
No comments yet