CVE-2017-16570

High

Published: 06/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value. It fails to reject requests that lack an x-csrf-token header.

Risk Assessment

The lack of proper CSRF protection can lead to unauthorized actions within the application, jeopardizing user data security.

Recommendation

It is recommended to upgrade KeystoneJS to version 4.0.0-beta.7 or later to secure the application against this type of attack.

Other vulnerabilities in KeystoneJS

CVE-2017-15879High
CSV Injection (also known as Excel Macro Injection or Formula Injection) exists in KeystoneJS before version 4.0.0-beta.7 via a value that is mishandled in a CSV export.

Original NVD description (English source)

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS