CVE-2023-34247
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Keystone is a content management system for Node.JS that has an open redirect vulnerability in the `@keystone-6/auth` package in versions 7.0.0 and prior. The redirect leading `/` filter can be bypassed, allowing users to be redirected to unexpected domains.
Risk Assessment
Attackers may exploit this vulnerability to redirect users to malicious sites, potentially leading to data theft or fraud. Organizations should be aware of the risks associated with using vulnerable versions of the package.
Recommendation
It is recommended to apply the patch from pull request 8626 or to avoid using the `@keystone-6/auth` package. Regularly updating system components will also help secure against similar vulnerabilities.
Original NVD description (English source)
Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.