GHSA-7cv6-gvx3-m54m

Source

https://github.com/advisories/GHSA-7cv6-gvx3-m54m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/11/GHSA-7cv6-gvx3-m54m/GHSA-7cv6-gvx3-m54m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7cv6-gvx3-m54m

Aliases

CVE-2017-15881

Published

2017-11-16T01:47:02Z

Modified

2023-11-08T03:58:58.974306Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-Site Scripting in keystone

Details

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an admin account.

Recommendation

Update to version 4.0.0 or later.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:22:30Z"
}

References

Affected packages

npm / keystone

Package

Name: keystone; View open source insights on deps.dev
Purl: pkg:npm/keystone

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.0.0-beta7

Database specific

{
    "last_known_affected_version_range": "<= 4.0.0-beta6"
}