CVE-2017-15878
UnknownEPSS 3.42%
Last modified
CVE-2017-15878 is a vulnerability of currently unknown severity. A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.. EPSS estimates a 3.42% chance of exploitation in the next 30 days.
Description
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Keystonejs | Keystone | < 4.0.0 | Beta7 |
References
- http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/101541Third Party Advisory, VDB Entry
- https://github.com/keystonejs/keystone/pull/4478Issue Tracking, Patch, Third Party Advisory
- https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.htmlExploit, Issue Tracking, Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43054/Exploit, Issue Tracking, Patch, Third Party Advisory, VDB Entry
- http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/101541Third Party Advisory, VDB Entry
- https://github.com/keystonejs/keystone/pull/4478Issue Tracking, Patch, Third Party Advisory
- https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.htmlExploit, Issue Tracking, Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43054/Exploit, Issue Tracking, Patch, Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-15878?
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
How severe is CVE-2017-15878?
Severity scoring for CVE-2017-15878 is pending analysis. The EPSS model estimates a 3.42% probability of exploitation in the next 30 days.
How do I fix CVE-2017-15878?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2017-15878?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST