A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
References
Link Resource
http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/ Issue Tracking Third Party Advisory
http://www.securityfocus.com/bid/101541 Third Party Advisory VDB Entry
https://github.com/keystonejs/keystone/pull/4478 Issue Tracking Patch Third Party Advisory
https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html Exploit Issue Tracking Patch Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/43054/ Exploit Issue Tracking Patch Third Party Advisory VDB Entry
History

No history.

cve-icon MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2017-10-24T21:00:00

Updated: 2017-10-26T09:57:01

Reserved: 2017-10-24T00:00:00


Link: CVE-2017-15878

JSON object: View

cve-icon NVD Information

Status : Analyzed

Published: 2017-10-24T21:29:00.517

Modified: 2017-11-14T15:11:20.240


Link: CVE-2017-15878

JSON object: View

cve-icon Redhat Information

No data.

CWE