Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-gg91-rpya-bfhq

Summary

URL Redirection to Untrusted Site ('Open Redirect')
Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.

Aliases

alias	CVE-2023-34247

alias	GHSA-jqxr-vjvv-899m

Fixed_packages

url	pkg:npm/%40keystone-6/auth@7.0.0
purl	pkg:npm/%40keystone-6/auth@7.0.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@7.0.0

Affected_packages

url pkg:npm/%40keystone-6/auth@0.0.0-rc-20221013033655

purl pkg:npm/%40keystone-6/auth@0.0.0-rc-20221013033655

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@0.0.0-rc-20221013033655

url pkg:npm/%40keystone-6/auth@0.0.0-rc-20230214225011

purl pkg:npm/%40keystone-6/auth@0.0.0-rc-20230214225011

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@0.0.0-rc-20230214225011

url pkg:npm/%40keystone-6/auth@0.0.0-rc-20230220024700

purl pkg:npm/%40keystone-6/auth@0.0.0-rc-20230220024700

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@0.0.0-rc-20230220024700

url pkg:npm/%40keystone-6/auth@1.0.0

purl pkg:npm/%40keystone-6/auth@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-9e59-6pzn-gyc1

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@1.0.0

url pkg:npm/%40keystone-6/auth@1.0.1

purl pkg:npm/%40keystone-6/auth@1.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-9e59-6pzn-gyc1

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@1.0.1

url pkg:npm/%40keystone-6/auth@2.0.0

purl pkg:npm/%40keystone-6/auth@2.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@2.0.0

url pkg:npm/%40keystone-6/auth@3.0.0

purl pkg:npm/%40keystone-6/auth@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@3.0.0

url pkg:npm/%40keystone-6/auth@4.0.0

purl pkg:npm/%40keystone-6/auth@4.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@4.0.0

url pkg:npm/%40keystone-6/auth@4.0.1

purl pkg:npm/%40keystone-6/auth@4.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@4.0.1

url pkg:npm/%40keystone-6/auth@5.0.0

purl pkg:npm/%40keystone-6/auth@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@5.0.0

url pkg:npm/%40keystone-6/auth@5.0.1

purl pkg:npm/%40keystone-6/auth@5.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@5.0.1

url pkg:npm/%40keystone-6/auth@6.0.0

purl pkg:npm/%40keystone-6/auth@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@6.0.0

url pkg:npm/%40keystone-6/auth@1.0.2

purl pkg:npm/%40keystone-6/auth@1.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-gg91-rpya-bfhq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540keystone-6/auth@1.0.2

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2023-34247

reference_id

reference_type

scores

value	0.00028
scoring_system	epss
scoring_elements	0.08399
published_at	2026-06-05T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2023-34247

reference_url

https://github.com/keystonejs/keystone

reference_id

reference_type

scores

value	6.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/keystonejs/keystone

reference_url

https://github.com/keystonejs/keystone/pull/8626

reference_id

reference_type

scores

value	6.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-03T18:06:53Z/

url

https://github.com/keystonejs/keystone/pull/8626

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2023-34247

reference_id

CVE-2023-34247

reference_type

scores

value	6.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2023-34247

reference_url	https://github.com/advisories/GHSA-jqxr-vjvv-899m
reference_id	GHSA-jqxr-vjvv-899m
reference_type
scores
url	https://github.com/advisories/GHSA-jqxr-vjvv-899m

reference_url

https://github.com/keystonejs/keystone/security/advisories/GHSA-jqxr-vjvv-899m

reference_id

GHSA-jqxr-vjvv-899m

reference_type

scores

value	6.1
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-03T18:06:53Z/

url

https://github.com/keystonejs/keystone/security/advisories/GHSA-jqxr-vjvv-899m

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	601
name	URL Redirection to Untrusted Site ('Open Redirect')
description	A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score 4.0 - 6.9

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gg91-rpya-bfhq

Vulnerability Instance