Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2017-15881

Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878.

CVSS v3:

  • Severity: Low
  • Score: 4.8
  • AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
keystonejs / keystone - 0.3.22.x
keystonejs / keystone 4.0.0 4.0.0.x
keystonejs / keystone 4.0.0-beta1 4.0.0-beta1.x
keystonejs / keystone 4.0.0-beta2 4.0.0-beta2.x
keystonejs / keystone 4.0.0-beta3 4.0.0-beta3.x
keystonejs / keystone 4.0.0-beta4 4.0.0-beta4.x
keystonejs / keystone 4.0.0-beta5 4.0.0-beta5.x
keystone - 4.0.0-beta7