GHSA-q43c-g2g7-6gxjHighCVSS 8.8

Cross-Site Request Forgery (CSRF) in keystone

Published
November 30, 2017
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2017-16570 →

📋 Description

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the X-CSRF-Token header, which may allow attackers to carry actions on behalf of other users on all endpoints.

Recommendation

Update to version 4.0.0 or later.

🎯 Affected products1

  • npm/keystone:<= 4.0.0-beta.6

🔗 References (9)