CVE-2017-15878

NONE EPSS 87.4%

Published Oct 24, 20178y ago · Modified Jun 17, 20262w ago

Published Oct 24, 2017 8y ago

Last Modified Jun 17, 2026 2w ago

Description

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.

Threat Intelligence

EPSS Exploit Probability

87.4% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
keystonejs	keystone	*	<4.0.0

References 5

blog.securelayer7.net http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/

Issue TrackingThird Party Advisory
securityfocus.com http://www.securityfocus.com/bid/101541

Third Party AdvisoryVDB Entry
github.com https://github.com/keystonejs/keystone/pull/4478

Issue TrackingPatchThird Party Advisory
packetstormsecurity.com https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html

ExploitIssue TrackingPatchThird Party AdvisoryVDB Entry
exploit-db.com https://www.exploit-db.com/exploits/43054/

ExploitIssue TrackingPatchThird Party AdvisoryVDB Entry

Remediation

github.com https://github.com/keystonejs/keystone/pull/4478

Issue TrackingPatchThird Party Advisory
packetstormsecurity.com https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html

ExploitIssue TrackingPatchThird Party AdvisoryVDB Entry
exploit-db.com https://www.exploit-db.com/exploits/43054/

ExploitIssue TrackingPatchThird Party AdvisoryVDB Entry