GitHub Advisoryadvisory · npm
GHSA-7cv6-gvx3-m54m Cross-Site Scripting in keystone
MEDIUM
Official page ↗
- Aliases
- CVE-2017-15881
- Ecosystem
- npm
- Packages
- keystone
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• npm keystone: < 4.0.0-beta7 → fixed in 4.0.0-beta7
Description
Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an admin account.
Recommendation
Update to version 4.0.0 or later.
Related
Alias · CVE (1)
- CVE-2017-15881 Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-15881 advisory
- https://github.com/keystonejs/keystone/issues/4437 web
- https://github.com/keystonejs/keystone/pull/4478 web
- https://github.com/advisories/GHSA-7cv6-gvx3-m54m advisory
- https://securelayer7.net/download/pdf/KeystoneJS-Pentest-Report-SecureLayer7.pdf web
- https://www.npmjs.com/advisories/981 web
- http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report web
- http://www.securityfocus.com/bid/101541 web