Vulnerability · Published Oct 25, 2022 · Assigned by GitHub_M
CVE-2022-39322@keystone-6/core vulnerable to field-level access-control bypass for multiselect field
Critical 9.1
In plain English
A critical-severity security flaw in keystone from keystonejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the `multiselect` field.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @keystone-6/core | 2.3.1 | GHSA-6mhr-52mv-6v6f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| keystonejs | keystone | >= 2.2.0, < 2.3.1 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N