CVE-2017-15881

Published October 24th, 2017

View on NVD ↗

CVSS v3

4.8

MEDIUM

CVSS v2

3.5

LOW

Affected

PROJECT

Description

Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878.

keystonejs/keystone

The superpowered headless CMS for Node.js — built with GraphQL and React

GitHub

9.88K