CVE-2022-39322

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the `multiselect` field.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
keystonejs	keystone	>= 2.2.0, < 2.3.1

References

https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7cPatch, Third Party Advisory
https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6fExploit, Third Party Advisory
https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7cPatch, Third Party Advisory
https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6fExploit, Third Party Advisory

Timeline

Published: Oct 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-393239.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-393243.5Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapsho CVE-2022-393256.1BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability o CVE-2022-393268.8kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusa CVE-2022-393279.8Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potentia CVE-2022-393288.1Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race conditi CVE-2022-393295.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise S CVE-2022-39335.4The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role a CVE-2022-393304.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 CVE-2022-393315.4Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Clien CVE-2022-393325.4Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Clien CVE-2022-393336.1Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Clien