Improper Access Control Affecting @keystone-6/core package, versions <5.5.1
Threat Intelligence
EPSS
0.07% (31st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-KEYSTONE6CORE-5843455
- published 16 Aug 2023
- disclosed 15 Aug 2023
- credit dcousens
Introduced: 15 Aug 2023
CVE-2023-40027 Open this link in a new tabHow to fix?
Upgrade @keystone-6/core to version 5.5.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Access Control when ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible (no session required). This is different from the behavior of the default AdminUI middleware, which by default will only be publicly accessible (no session required) if a session strategy is not defined.
Workaround
Users unable to upgrade may opt to write their own isAccessAllowed functionality to work around this vulnerability.
References
CVSS Scores
version 3.1