CVE-2015-9240 Authentication Weakness in keystone
HighCVSS 7.5
EPSS 0.86%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm keystone(npm) | < 0.3.16 | 0.3.16 |
| keystonejs @keystonejs/keystone | < 0.3.16 | 0.3.16 |
| HackerOne keystone node module | = <0.3.16 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- www.npmjs.com
- nodesecurity.io third-party-advisory