CVE-2015-9240 Authentication Weakness in keystone
Incomplete email matching in the keystone library allows attackers to bypass authentication checks, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-9240?
CVE-2015-9240 is a high-severity authentication bypass vulnerability in HackerOne keystone node module, published on 29 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
Weakness: CWE-255
Which versions are affected by CVE-2015-9240?
2 open source packages ship an affected version, including keystone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keystone npm | All versions | 0.3.16 |
keystone npm | All versions | 0.3.16 |
Products include Keystonejs Keystone.
How do I fix CVE-2015-9240?
Upgrade keystone to 0.3.16 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-9240 being exploited?
There is no known exploitation of CVE-2015-9240 in the wild and no public exploit code.
Other vulnerabilities in HackerOne keystone node module
- CVE-2022-39382 NODE_ENV in Keystone defaults to development with esbuild
- CVE-2022-29354 File upload in n/a
- CVE-2022-39322 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field
- CVE-2017-16570 Cross-Site Request Forgery (CSRF) in keystone
- CVE-2017-15879 Keystone is vulnerable to CSV injection
Sources
Also known as GHSA-39pj-gq8q-9pfj.