Cross-Site Scripting Vulnerability in KeystoneJS by KeystoneJS
CVE-2017-15881

4.8MEDIUM

Key Information:

Vendor

Keystonejs

Status
Keystone
Vendor
CVE Published:
24 October 2017

What is CVE-2017-15881?

The KeystoneJS framework prior to version 4.0.0-beta.7 is susceptible to a Cross-Site Scripting vulnerability that enables authenticated administrators to inject arbitrary scripts or HTML through the 'content brief' or 'content extended' fields. This vulnerability presents serious security risks as it could lead to execution of malicious scripts in users' browsers, compromising sensitive data and website integrity.

References

http://www.securityfocus.com/bid/101541
vdb-entryx_refsource_BID
http://blog.securelayer7.net/keystonejs-open-source-penet...
x_refsource_MISC
https://github.com/keystonejs/keystone/issues/4437
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.