@keystone-6/auth Open Redirect vulnerability
CVE-2023-34247

4.1MEDIUM

Key Information:

Vendor

keystonejs

Status
keystone
Vendor
CVE Published:
13 June 2023

What is CVE-2023-34247?

Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the @keystone-6/auth package.

Affected Version(s)

keystone <= 7.0.0

References

https://github.com/keystonejs/keystone/security/advisorie...
x_refsource_CONFIRM
https://github.com/keystonejs/keystone/pull/8626
x_refsource_MISC

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.