Description

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.

Remediation

References

https://nodesecurity.io/advisories/60

Related Vulnerabilities

CVE-2022-45206 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

CVE-2011-4838 Vulnerability in maven package com.sun.grizzly:jruby

CVE-2017-16003 Vulnerability in npm package windows-build-tools

CVE-2021-25329 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2020-5251 Vulnerability in npm package parse-server

Severity

High

Classification

CWE-255 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory