Cross-site Request Forgery (CSRF) Affecting keystone package, versions <4.0.0-beta.7
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.23% (62nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-KEYSTONE-449663
- published 12 Jun 2019
- disclosed 6 Nov 2017
- credit Unknown
Introduced: 6 Nov 2017
CVE-2017-16570 Open this link in a new tabHow to fix?
Upgrade keystone to version 4.0.0-beta.7 or higher.
Overview
keystone is a Node.js content management system and web app framework built on the Express web framework and Mongoose ODM.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). It fails to reject requests that lack an x-csrf-token header.
CVSS Scores
version 3.1