Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-39305 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-04-22T17:17:55.515Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: flipped-aurora Products: gin-vue-admin Problem Types: CWE-434 Description: Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
tched in 2.5.4b. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-wrmq-4v4c-gxp2 - https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/breakpoint_continue.go
CVE ID: CVE-2022-39306 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-04-23T16:39:48.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: grafana Products: grafana Problem Types: CWE-20 Description: Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign
il invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84 - https://security.netapp.com/advisory/ntap-20221215-0004/
CVE ID: CVE-2022-39307 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-04-23T16:39:42.641Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: grafana Products: grafana Problem Types: CWE-200 Description: Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are
nticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5 - https://security.netapp.com/advisory/ntap-20221215-0004/
CVE ID: CVE-2022-39308 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-04-23T16:50:02.531Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: gocd Products: gocd Problem Types: CWE-208, CWE-1254 Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 (inclusive) are subject to a timing attack in validation of access tokens due to use of regular string comparison for validation of the token rather than a constant time algorithm. This could allow a brute force attack on GoCD server API calls to observ
he token rather than a constant time algorithm. This could allow a brute force attack on GoCD server API calls to observe timing differences in validations in order to guess an access token generated by a user for API access. This issue is fixed in GoCD version 19.11.0. As a workaround, users can apply rate limiting or insert random delays to API calls made to GoCD Server via a reverse proxy or other fronting web server. Another workaround, users may disallow use of access tokens by users by having an administrator revoke all access tokens through the "Access Token Management" admin function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gi
nt" admin function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-999p-fp84-jcpq - https://github.com/gocd/gocd/commit/236d4baf92e6607f2841c151c855adcc477238b8 - https://github.com/gocd/gocd/releases/tag/19.11.0 - https://www.gocd.org/releases/#19-11-0
CVE ID: CVE-2022-39309 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-04-23T16:49:57.083Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: gocd Products: gocd Problem Types: CWE-200, CWE-499 Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoCD configuration to authenticated agents. A malicious/compromised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets inten
mised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets intended for other agents/environments if they also are able to obtain access to encrypted configuration values from the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gocd.org/releases/#21-1-0 - https://github.com/gocd/gocd/security/advisories/GHSA-f9qg-xcxq-cgv9 - https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a - https://github.com/gocd/gocd/releases/tag/21.1.0
CVE ID: CVE-2022-39310 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-04-23T16:49:51.031Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: gocd Products: gocd Problem Types: CWE-284 Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive work packages for other agents due to broken access control and incorrect validation of agent tokens within the GoCD server. Since work packages can contain sensitive information such as cr
rect validation of agent tokens within the GoCD server. Since work packages can contain sensitive information such as credentials intended only for a given job running against a specific agent environment, this can cause accidental information disclosure. Exploitation requires knowledge of agent identifiers and ability to authenticate as an existing agent with the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gocd.org/releases/#21-1-0 - https://github.com/gocd/gocd/security/advisories/GHSA-4fp5-33jh-hgcq - https://github.com/gocd/gocd/pull
eases/#21-1-0 - https://github.com/gocd/gocd/security/advisories/GHSA-4fp5-33jh-hgcq - https://github.com/gocd/gocd/pull/8877
CVE ID: CVE-2022-39311 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-04-23T16:49:45.317Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: gocd Products: gocd Problem Types: CWE-502 Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromised agent. The Spring RemoteInvocation endpoint exposed agent communication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitati
unication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitation requires agent-level authentication, thus an attacker would need to either compromise an existing agent, its network communication or register a new agent to practically exploit this vulnerability. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-2hjh-3p3p-8hcm - https://github.com/gocd/gocd/commit/7b88b70d6f7f429562d5cab49a80ea856e34cdc8 - https://www.gocd.org/releases/#21-1-0
CVE ID: CVE-2022-39312 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-22T17:17:45.319Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dataease Products: dataease Problem Types: CWE-20, CWE-502 Description: Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attack
ease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2 - https://github.com/dataease/dataease/pull/3328 - https://github.com/dataease/dataease/commit/956ee
GHSA-q4qq-jhjv-7rh2 - https://github.com/dataease/dataease/pull/3328 - https://github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d - https://github.com/dataease/dataease/releases/tag/v1.15.2
CVE ID: CVE-2022-39313 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-04-23T16:45:01.017Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-1284 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been patched in versions 4.10.17, and 5.2.8. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA A
versions 4.10.17, and 5.2.8. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3
CVE ID: CVE-2022-39314 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-04-23T16:44:52.580Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: getkirby Products: kirby Problem Types: CWE-307 Description: Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `password-reset` auth method with the `auth.methods` option or if you have enabled the `debug` option in production. By using two or more IP addresses and multiple login attempts, valid u
ou have enabled the `debug` option in production. By using two or more IP addresses and multiple login attempts, valid user accounts will lock, but invalid accounts will not, leading to account enumeration. This issue has been patched in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. If you cannot update immediately, you can work around the issue by setting the `auth.methods` option to `password`, which disables the code-based login and password reset forms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getkirby/kirby/security/advisories/GHSA-43qq-qw4x-28f8
CVE ID: CVE-2022-39315 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-23T16:44:44.886Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: getkirby Products: kirby Problem Types: CWE-204 Description: Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1, and Kirby 3.8.1. In all of the mentioned r
The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1, and Kirby 3.8.1. In all of the mentioned releases, the maintainers have rewritten the affected code so that the delay is also inserted after the brute force limit is reached. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getkirby/kirby/security/advisories/GHSA-c27j-76xg-6x4f - https://github.com/getkirby/kirby/releases/tag/3.5.8.2 - https://github.com/getkirby/kirby/releases/tag/3.6.6.2 - https://github.com/getkirby/kirby/releases/tag/3.7.5.1 - https://github.com/getkirby/kirby/releases/tag/3.8.1
CVE ID: CVE-2022-39316 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-11-03T20:34:58.674Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github
0 release. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm - https://github.com/FreeRDP/FreeRDP/commit/e865c24efc40ebc52e75979c94cdd4ee2c1495b0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2022-39317 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-23T16:37:08.327Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
own workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2022-39318 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-11-03T20:35:00.403Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-20, CWE-369 Description: FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch. Additional Analyst Notes: - CVE Program Container: Refe
unable to upgrade should not use the `/usb` redirection switch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35 - https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2022-39319 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-11-03T20:35:02.656Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch. Additional Analyst Note
rs are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh - https://github.com/FreeRDP/FreeRDP/commit/11555828d2cf289b350baba5ad1f462f10b80b76 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html - https://security.gentoo.org/glsa/202401-1
NLC74B/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2022-39320 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-11-03T20:35:04.139Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not us
is issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2022-39321 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-23T16:44:36.866Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: actions Products: runner Problem Types: CWE-78 Description: GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered in versions prior to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 that allows an input to escape the environment variable and modify
or to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 that allows an input to escape the environment variable and modify that docker command invocation directly. Jobs that use container actions, job containers, or service containers alongside untrusted user inputs in environment variables may be vulnerable. The Actions Runner has been patched, both on `github.com` and hotfixes for GHES and GHAE customers in versions 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4. GHES and GHAE customers may want to patch their instance in order to have their runners automatically upgrade to these new runner versions. As a workaround, users may consider removing any container actions, job containers, or serv
o these new runner versions. As a workaround, users may consider removing any container actions, job containers, or service containers from their jobs until they are able to upgrade their runner versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/actions/runner/security/advisories/GHSA-2c6m-6gqh-6qg3 - https://github.com/actions/runner/pull/2107 - https://github.com/actions/runner/pull/2108
CVE ID: CVE-2022-39322 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-22T17:17:35.770Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: keystonejs Products: keystone Problem Types: CWE-285 Description: @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affe