Description

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.

Remediation

References

http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/

http://www.securityfocus.com/bid/101541

https://github.com/keystonejs/keystone/pull/4478

https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html

https://www.exploit-db.com/exploits/43054/

Related Vulnerabilities

CVE-2018-5158 Vulnerability in npm package pdfjs-dist

CVE-2022-29257 Vulnerability in maven package org.webjars.npm:electron

CVE-2021-21348 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2012-3451 Vulnerability in maven package org.apache.cxf:cxf-api

CVE-2022-24999 Vulnerability in npm package express

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Third Party Advisory VDB Entry Patch Exploit