Cross-Site Request Forgery (CSRF) in keystone (GHSA-q43c-g2g7-6gxj)
Published: 2017-11-30T23:14:47Z
Aliases: CVE-2017-16570
Severity: HIGH · CWE: CWE-352

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the `X-CSRF-Token` header, which may allow attackers to carry actions on behalf of other users on all endpoints.


## Recommendation

Update to version 4.0.0 or later.

Affected packages:
package: ecosystem: npm
name: keystone
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.0-beta.7
database_specific: last_known_affected_version_range: <= 4.0.0-beta.6