In short
- CVE-2017-16570 is a HIGH (CVSS 8.8) vulnerability affecting keystone (keystonejs), keystone.
- Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.6% of all vulnerabilities.
- Fix: update to 4.0.0, 4.0.0-beta.7 or later.
| Package | Affected versions | Patched versions |
|---|
| keystone | < 4.0.0
| 4.0.0
|
| keystone npm | < 4.0.0-beta.7
| 4.0.0-beta.7
|
Description
Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the X-CSRF-Token header, which may allow attackers to carry actions on behalf of other users on all endpoints.
Recommendation
Update to version 4.0.0 or later.
NVD description
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free