{"id":"CVE-2017-15881","details":"Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the \"content brief\" or \"content extended\" field, a different vulnerability than CVE-2017-15878.","aliases":["GHSA-7cv6-gvx3-m54m"],"modified":"2026-08-07T11:31:25.279236489Z","published":"2017-10-24T22:29:00.240Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:keystonejs:keystone:4.0.0:beta1:*:*:*:node.js:*:*","cpe:2.3:a:keystonejs:keystone:4.0.0:beta2:*:*:*:node.js:*:*","cpe:2.3:a:keystonejs:keystone:4.0.0:beta3:*:*:*:node.js:*:*","cpe:2.3:a:keystonejs:keystone:4.0.0:beta4:*:*:*:node.js:*:*","cpe:2.3:a:keystonejs:keystone:4.0.0:beta5:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"4.0.0-beta1"},{"last_affected":"4.0.0-beta1"},{"introduced":"4.0.0-beta2"},{"last_affected":"4.0.0-beta2"},{"introduced":"4.0.0-beta3"},{"last_affected":"4.0.0-beta3"},{"introduced":"4.0.0-beta4"},{"last_affected":"4.0.0-beta4"},{"introduced":"4.0.0-beta5"},{"last_affected":"4.0.0-beta5"}],"source":"CPE_STRING","vendor_product":"keystonejs:keystone"}]},"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/101541"},{"type":"REPORT","url":"http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/"},{"type":"REPORT","url":"https://github.com/keystonejs/keystone/issues/4437"},{"type":"FIX","url":"https://github.com/keystonejs/keystone/pull/4478"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keystonejs/keystone","events":[{"introduced":"0"},{"last_affected":"16087418577d5e9d8f88dd78a4332b7053b2688d"},{"introduced":"09685b8e0c50ae45ef43df60e3642064e6275734"},{"last_affected":"09685b8e0c50ae45ef43df60e3642064e6275734"}],"database_specific":{"cpe":["cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:node.js:*:*","cpe:2.3:a:keystonejs:keystone:4.0.0:-:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"0.3.22"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["4.0.0-NA","v4.0.0","v0.3.22","v0.3.21","v0.3.20","v0.3.17","v0.3.15","v0.3.13","v0.3.12","v0.3.11","v0.3.10","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0","v0.0.43","v0.0.42","v0.0.41","v0.0.40","v0.0.39","v0.0.38","v0.0.37","v0.0.35","v0.0.34","v0.0.33","v0.0.30","v0.0.29","v0.0.28","v0.0.27","v0.0.26","v0.0.25","v0.0.24","v0.0.23","v0.0.22","v0.0.20","v0.0.19","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15881.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}