CVE-2017-15879 Keystone is vulnerable to CSV injection
HighCVSS 8.8
EPSS 7.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm keystone(npm) | <= 4.0.0-beta5 | No fix listed |
| keystonejs @keystonejs/keystone | <= 4.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 43053 exploit third-party-advisory vdb-entry