Is CVE-2015-9240 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-9240 being exploited in the wild.

How severe is CVE-2015-9240?

Low severity, with a CVSS score of 3, published 7 June 2018.

Is there a fix for CVE-2015-9240?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2015-9240 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-9240?

Check whether you run KeystoneJS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-9240: KeystoneJS Keystone authentication bypass via partial email matching

CVE-2015-9240 · Severity: low · CVSS 3 · Published 2018-06-07

Keystone, a popular Node.js content management system and web framework, contains a flaw in its default login system. An attacker who knows a user's password can successfully log in even if they only provide a partial or incomplete email address. This could allow unauthorized access to administrative accounts if an attacker can guess or obtain passwords and use shortened versions of target email addresses.

Technologies: KeystoneJS. Vendors: KeystoneJS.

Quick answers

Is CVE-2015-9240 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-9240 being exploited in the wild.
How severe is CVE-2015-9240?: Low severity, with a CVSS score of 3, published 7 June 2018.
Which products and versions are affected?: KeystoneJS < 0.3.16.
Is there a fix for CVE-2015-9240?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2015-9240 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-9240?: Check whether you run KeystoneJS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the default sign-in functionality of the Keystone node module (prior to version 0.3.16) allows for a partial authentication bypass. The root cause is a bug in the email matching logic where incomplete email addresses are incorrectly validated against the database. While a correct password is still required for authentication, an attacker can gain access by providing only a substring or partial match of a valid user's email address. This is reachable over the network without prior authentication. The issue was addressed in version 0.3.16.

Affected products

KeystoneJS keystone < 0.3.16

Identifiers

CVE-2015-9240
GHSA-39pj-gq8q-9pfj

Timeline

2015-01-01: other: Vulnerability identified (based on CVE year)
2018-05-29: disclosed: NVD Published Date
2018-06-07: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.