GHSA-7cv6-gvx3-m54m

Cross-Site Scripting in keystone

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-15881

Packages

Ecosystem	Package	Affected	Fixed in
npm	keystone	< 4.0.0-beta7	4.0.0-beta7

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an admin account. ## Recommendation Update to version 4.0.0 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-15881 advisory
https://github.com/keystonejs/keystone/issues/4437 web
https://github.com/keystonejs/keystone/pull/4478 web
https://github.com/advisories/GHSA-7cv6-gvx3-m54m advisory
https://securelayer7.net/download/pdf/KeystoneJS-Pentest-Report-SecureLayer7.pdf web
https://www.npmjs.com/advisories/981 web
http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report web
http://www.securityfocus.com/bid/101541 web