@keystone-6/auth Open Redirect vulnerability

TRUNG BÌNH 4.1CVE-2023-34247 · GHSA-jqxr-vjvv-899m · Công bố 13/06/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-34247 là lỗ hổng mức TRUNG BÌNH (CVSS 4.1) ảnh hưởng keystone (keystonejs), @keystone-6/auth.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.41%, cao hơn 35.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
keystone keystonejs	`≤ 7.0.0`	Chưa có bản vá
@keystone-6/auth npm	`< 7.0.0`	`7.0.0`

Mô tả

Summary

There is an open redirect in the @keystone-6/auth package, where the redirect leading / filter can be bypassed.

Impact

Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location.

Mitigations

Don't use the @keystone-6/auth package

References

Similar Vulnerability Reports

Credits

Thanks to morioka12 for reporting this problem.

If you have any questions around this security advisory, please don't hesitate to contact us at [email protected], or open an issue on GitHub.

If you have a security flaw to report for any software in this repository, please see our SECURITY policy.

Mô tả của NVD

Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.