Lucene search

K

Keystonejs Security Vulnerabilities

cve
cve

CVE-2023-40027

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will...

5.3CVSS

5.2AI Score

0.001EPSS

2023-08-15 06:15 PM
2330
cve
cve

CVE-2023-34247

Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to...

6.1CVSS

4.5AI Score

0.0004EPSS

2023-06-13 05:15 PM
16
cve
cve

CVE-2022-39382

Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/[email protected] || 3.0.1 users that use NODE_ENV to trigger security-sensitive functionality in their production builds are vulnerable to NODE_ENV being inlined to "development" for user code, irrespective of what your...

9.8CVSS

9.6AI Score

0.002EPSS

2022-11-03 02:15 PM
31
6
cve
cve

CVE-2022-39322

@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their multiselect fields to use the field-level access control - if configured - are vulnerable to their field-level access control....

9.8CVSS

9.4AI Score

0.002EPSS

2022-10-25 05:15 PM
30
6
cve
cve

CVE-2022-29354

An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted...

9.8CVSS

9.4AI Score

0.003EPSS

2022-05-16 02:15 PM
40
2
cve
cve

CVE-2022-0087

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site...

6.1CVSS

6.1AI Score

0.001EPSS

2022-01-12 12:15 AM
49
cve
cve

CVE-2021-32624

Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control...

7.5CVSS

5AI Score

0.001EPSS

2021-05-24 05:15 PM
30
2
cve
cve

CVE-2015-9240

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign...

7.5CVSS

7.5AI Score

0.001EPSS

2018-05-29 08:29 PM
22
cve
cve

CVE-2017-16570

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token...

8.8CVSS

8.6AI Score

0.002EPSS

2017-11-06 08:29 AM
28
cve
cve

CVE-2017-15881

Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than...

4.8CVSS

5.1AI Score

0.003EPSS

2017-10-24 10:29 PM
28
cve
cve

CVE-2017-15878

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us...

6.1CVSS

5.2AI Score

0.003EPSS

2017-10-24 09:29 PM
43
cve
cve

CVE-2017-15879

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV...

8.8CVSS

8.6AI Score

0.014EPSS

2017-10-24 09:29 PM
46