| Package | Affected versions | Patched versions |
|---|---|---|
| keystone | < 4.0.0 | 4.0.0 |
| keystone | < 4.0.0-beta.7 | 4.0.0-beta.7 |
Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the X-CSRF-Token header, which may allow attackers to carry actions on behalf of other users on all endpoints.
Update to version 4.0.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free