Medium severity6.1NVD Advisory· Published Jun 13, 2023· Updated Jun 17, 2026
CVE-2023-34247
CVE-2023-34247
Description
Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the @keystone-6/auth package.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@keystone-6/authnpm | < 7.0.0 | 7.0.0 |
Affected products
3cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:node.js:*:*range: <=7.0.0
- (no CPE)range: <= 7.0.0
Patches
Vulnerability mechanics
References
4- github.com/keystonejs/keystone/pull/8626nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-jqxr-vjvv-899mghsaADVISORY
- github.com/keystonejs/keystone/security/advisories/GHSA-jqxr-vjvv-899mnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-34247ghsaADVISORY
News mentions
0No linked articles in our index yet.