PT-2017-14258 · Keystonejs · Keystonejs

Ishaq Mohammed · Publicado 2017-10-24 · Atualizado 2017-11-16 · CVE-2017-15879

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KeystoneJS versions prior to 4.0.0-beta.7

Description A CSV Injection issue exists due to mishandled values in CSV exports. This issue affects the admin/server/api/download.js and lib/list/getCSVData.js files.

Recommendations For versions prior to 4.0.0-beta.7, update to version 4.0.0-beta.7 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-15879

GHSA-6494-V9FQ-FGQ2

Produtos afetados

Keystonejs

Referências · 7

• 🔥 https://exploit-db.com/exploits/43053 · Exploit
• https://github.com/keystonejs/keystone/pull/4478 · Correção
• https://osv.dev/vulnerability/GHSA-6494-v9fq-fgq2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15879 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15879 · Aviso do Fabricante
• https://packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html · Nota
• https://github.com/advisories/GHSA-6494-v9fq-fgq2 · Nota