漏洞标题
"@keystone-6/core vulnerable to field-level access-control bypass for multiselect field" 翻译成中文为：“keystone-6/core 存在对多选字段的字段级访问控制绕过漏洞。”
漏洞描述信息
@keystone-6/core对多选字段的字段级访问控制绕过漏洞易受攻击
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
漏洞类别
N/A
漏洞标题
@keystone-6/core vulnerable to field-level access-control bypass for multiselect field
漏洞描述信息
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the `multiselect` field.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
漏洞类别
授权机制不恰当
漏洞标题
Keystone 授权问题漏洞
漏洞描述信息
Keystone是一款强大的CMS。用于帮助您比任何其他 Cms 或应用程序框架更快地构建和扩展。 Keystone 2.3.1之前版本存在授权问题漏洞，该漏洞源于使用字段级访问控制的用户很容易受到未使用其字段级访问控制的影响。
CVSS信息
N/A
漏洞类别
授权问题