PT-2017-14258 · Keystonejs · Keystonejs

Ishaq Mohammed · Published 2017-10-24 · Updated 2017-11-16 · CVE-2017-15879

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KeystoneJS versions prior to 4.0.0-beta.7

Description A CSV Injection issue exists due to mishandled values in CSV exports. This issue affects the admin/server/api/download.js and lib/list/getCSVData.js files.

Recommendations For versions prior to 4.0.0-beta.7, update to version 4.0.0-beta.7 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-15879

GHSA-6494-V9FQ-FGQ2

Affected Products

Keystonejs

References · 7

• 🔥 https://exploit-db.com/exploits/43053 · Exploit
• https://github.com/keystonejs/keystone/pull/4478 · Patch
• https://osv.dev/vulnerability/GHSA-6494-v9fq-fgq2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15879 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15879 · Vendor Advisory
• https://packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html · Note
• https://github.com/advisories/GHSA-6494-v9fq-fgq2 · Note