CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40027 – Conditionally missing authorization in @keystone-6/core
https://notcve.org/view.php?id=CVE-2023-40027
15 Aug 2023 — Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible (no session required) if a `session` strategy is not defined. This vulnerability does not affect developers using the `@keystone-6/auth` package, or any users that have written their ... • https://github.com/keystonejs/keystone/commit/650e27e6e9b42abfb94c340c8470faf61f0ff284 • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34247 – @keystone-6/auth Open Redirect vulnerability
https://notcve.org/view.php?id=CVE-2023-34247
13 Jun 2023 — Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package. • https://github.com/keystonejs/keystone/pull/8626 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-39382 – NODE_ENV in Keystone defaults to development with esbuild
https://notcve.org/view.php?id=CVE-2022-39382
03 Nov 2022 — Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` for user code, irrespective of what your environment variables. If you do not use `NODE_ENV` in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use `NODE_ENV` to trigger p... • https://github.com/keystonejs/keystone/pull/8031 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39322 – @keystone-6/core vulnerable to field-level access-control bypass for multiselect field
https://notcve.org/view.php?id=CVE-2022-39322
25 Oct 2022 — @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. • https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29354
https://notcve.org/view.php?id=CVE-2022-29354
16 May 2022 — An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file. Una vulnerabilidad de carga de archivos arbitraria en el módulo de carga de archivos de Keystone versión v4.2.1, permite a atacantes ejecutar código arbitrario por medio de un archivo diseñado • https://www.youtube.com/watch?v=DOM20FKpQQw • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.1EPSS: 49%CPEs: 1EXPL: 1CVE-2022-0087 – Cross-site Scripting (XSS) - Reflected in keystonejs/keystone
https://notcve.org/view.php?id=CVE-2022-0087
11 Jan 2022 — keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') keystone es vulnerable a una Neutralización Inapropiada de Entradas Durante la Generación de Páginas Web ("Cross-site Scripting") • https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32624 – Private Field data leak
https://notcve.org/view.php?id=CVE-2021-32624
24 May 2021 — Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent beh... • https://github.com/keystonejs/keystone-5/security/advisories/GHSA-27g8-r9vw-765x • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9240
https://notcve.org/view.php?id=CVE-2015-9240
29 May 2018 — Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in. Debido a un error en la funcionalidad de inicio de sesión por defecto en el módulo keystone node en versiones anteriores a la 0.3.16, las direcciones de correo electrónico incompletas podrían coincidir. Sigue siendo necesaria una contraseña correcta para completar el inicio de sesión. • https://nodesecurity.io/advisories/60 • CWE-255: Credentials Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2017-16570 – KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2017-16570
06 Nov 2017 — KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header. KeystoneJS en versiones anteriores a la 4.0.0-beta.7 permite la omisión CSRF de la aplicación mediante la eliminación del parámetro y el valor CSRF. Esto también se conoce como SecureLayer7 issue number SL7_KEYJS_03. En otras palabras, fracasa a la hora de rechazar peticiones que ... • https://packetstorm.news/files/id/146133 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 7EXPL: 0CVE-2017-15881
https://notcve.org/view.php?id=CVE-2017-15881
24 Oct 2017 — Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878. Vulnerabilidad Cross-Site Scripting (XSS) en KeystoneJS en versiones anteriores a la 4.0.0-beta.7 permite que administradores autenticados remotos inyecten scripts web o HTML arbitrarios mediante el campo "content brief" o "content extended". Esta es una vulner... • http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •