Kurz gesagt
- CVE-2017-16570 ist eine Schwachstelle (HOCH (CVSS 8.8)) in keystone (keystonejs), keystone.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.2%, höher als bei 82.6% aller Schwachstellen.
- Abhilfe: auf 4.0.0, 4.0.0-beta.7 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| keystone | < 4.0.0
| 4.0.0
|
| keystone npm | < 4.0.0-beta.7
| 4.0.0-beta.7
|
Description
Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the X-CSRF-Token header, which may allow attackers to carry actions on behalf of other users on all endpoints.
Recommendation
Update to version 4.0.0 or later.
NVD description
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free