GitHub Advisoryadvisory · npm

GHSA-39pj-gq8q-9pfj Authentication Weakness in keystone

HIGH Published 2018-06-07 Modified 2021-08-31 Official page ↗
Aliases
CVE-2015-9240
Ecosystem
npm
Packages
keystone
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1255
Reviewed
2020-06-16

Affected packages

• npm keystone: < 0.3.16 → fixed in 0.3.16

Description

Versions of `keystone` prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted. Recommendation Update to version 0.3.16 or later.

Related

Alias · CVE (1)

  • CVE-2015-9240 Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be… vulnerability

Weakness · CWE (1)

  • CWE-1255 Comparison Logic is Vulnerable to Power Side-Channel Attacks weakness

References