CVE-2022-0087
HIGH7.1EPSS 56.1%Reflected cross-site scripting (XSS) vulnerability
Description
This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package. #### Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page. This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability. ## Vulnerability mitigation Please upgrade to `@keystone-6/auth >= 1.0.2`, where this vulnerability has been closed. If you are using `@keystone-next/auth`, we **strongly** recommend you upgrade to `@keystone-6`. ### Workarounds If for some reason you cannot upgrade the dependencies in software, you could alternatively - disable the administration user interface, or - if using a reverse-proxy, strip query parameters when accessing the administration interface ### References https://owasp.org/www-community/attacks/xss/ Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability
Affected packages (2)
- npm/@keystone-6/authfrom 0, < 1.0.2
- npm/@keystone-next/authfrom 0, <= 37.0.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
References (5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-0087
- PATCHhttps://github.com/keystonejs/keystone
- WEBhttps://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
- WEBhttps://github.com/keystonejs/keystone/security/advisories/GHSA-hrgx-7j6v-xj82
- WEBhttps://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e