CVE-2017-15879

NONE EPSS 93.6%

Published Oct 24, 20178y ago · Modified Jun 17, 20262w ago

Published Oct 24, 2017 8y ago

Last Modified Jun 17, 2026 2w ago

Description

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

Threat Intelligence

EPSS Exploit Probability

93.6% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

Vendor	Product	Version	Range
keystonejs	keystone	*	≤4.0.0

References 3

github.com https://github.com/keystonejs/keystone/pull/4478

Issue TrackingPatchThird Party Advisory
packetstormsecurity.com https://packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html

Third Party AdvisoryVDB Entry
exploit-db.com https://www.exploit-db.com/exploits/43053/

Third Party AdvisoryVDB Entry

Remediation

github.com https://github.com/keystonejs/keystone/pull/4478

Issue TrackingPatchThird Party Advisory