CVE-2015-9240: Authentication Weakness in keystone
Summary
CVE-2015-9240: Authentication Weakness in keystone. Affects keystone versions < 0.3.16. Fixed in 0.3.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an npm package that provides authentication and authorization services for Node.js applications. It is used to manage user authentication and access control in web applications. The vulnerability in Keystone versions prior to 0.3.16 allows for a partial authentication bypass. When an attacker provides a correct password but only part of the associated email address during the sign-in process, authentication is granted.
Vulnerability Detail
The vulnerability arises from a flaw in the default sign-in functionality of Keystone. By exploiting this weakness, an attacker can gain unauthorized access to user accounts by providing a valid password and manipulating the email address input. This can lead to unauthorized access to sensitive information, privilege escalation, and potential data breaches. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.3.16
This is the first release that contains the fix.
npm install keystone@0.3.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability in Keystone versions prior to 0.3.16 allows for a partial authentication bypass, potentially leading to unauthorized access and data breaches. To mitigate this vulnerability, it is crucial to update Keystone to version 0.3.16 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
Keystone is an npm package that provides authentication and authorization services for Node.js applications. It helps manage user authentication and access control in web applications.
The vulnerability allows for a partial authentication bypass, enabling attackers to gain unauthorized access to user accounts by manipulating the email address input during the sign-in process.
To mitigate this vulnerability, update Keystone to version 0.3.16 or later. This update includes a patch that addresses the authentication weakness and prevents partial bypasses.
No, there is no known workaround for this vulnerability. It is recommended to update to the patched version of Keystone.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.