GHSA-9xgp-hfw7-73rq

Source

https://github.com/advisories/GHSA-9xgp-hfw7-73rq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-9xgp-hfw7-73rq/GHSA-9xgp-hfw7-73rq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9xgp-hfw7-73rq

Withdrawn

2020-08-19T21:30:04Z

Published

2020-08-19T21:30:04Z

Modified

2020-08-19T21:30:04Z

Summary

Authentication Weakness in keystone

Details

There is an authentication weakness vulnerability in keystone before version 0.3.16. Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-05-29T19:21:31Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

https://github.com/keystonejs/keystone/issues/1085

Affected packages

npm / keystone

Package

Name: keystone; View open source insights on deps.dev
Purl: pkg:npm/keystone

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-9xgp-hfw7-73rq/GHSA-9xgp-hfw7-73rq.json"