CVE-2022-0087 – @keystone-6/auth

Package

Manager: npm
Name: @keystone-6/auth
Vulnerable Version: >=0 <1.0.2

Severity

Level: High

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.56131 pctl0.98026

Details

Reflected cross-site scripting (XSS) vulnerability This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package. #### Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page. This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability. ## Vulnerability mitigation Please upgrade to `@keystone-6/auth >= 1.0.2`, where this vulnerability has been closed. If you are using `@keystone-next/auth`, we **strongly** recommend you upgrade to `@keystone-6`. ### Workarounds If for some reason you cannot upgrade the dependencies in software, you could alternatively - disable the administration user interface, or - if using a reverse-proxy, strip query parameters when accessing the administration interface ### References https://owasp.org/www-community/attacks/xss/ Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability

Metadata

Created: 2022-01-12T21:55:40Z
Modified: 2022-01-19T17:42:16Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-hrgx-7j6v-xj82/GHSA-hrgx-7j6v-xj82.json
CWE IDs: ["CWE-79"]
Alternative ID: GHSA-hrgx-7j6v-xj82
Finding: F008
Auto approve: 1