CVE-2022-39322: @keystone-6/core vulnerable to field-level access-control bypass for multiselect field
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their multiselect fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than multiselect are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the multiselect field.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39322?
CVE-2022-39322 has been rated as a moderate severity vulnerability.
How do I fix CVE-2022-39322?
To fix CVE-2022-39322, upgrade KeystoneJS to version 2.3.1 or later.
Which versions of KeystoneJS are affected by CVE-2022-39322?
CVE-2022-39322 affects KeystoneJS versions between 2.2.0 and 2.3.1, inclusive of 2.2.0.
What types of fields are impacted by CVE-2022-39322?
CVE-2022-39322 specifically impacts the 'multiselect' fields that utilize field-level access control.
Are there any known workarounds for CVE-2022-39322?
There are no documented workarounds for CVE-2022-39322; updating is recommended.