{"action":"Upgrade keystone to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"keystone","cve_ids":["CVE-2017-15878"],"ecosystem":"npm","epss":0.03415,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-7qcx-jmrc-h2rr","id":"tcs_01M5KFAPAZ0NK8AANZC8KER1DZ","modified_at":"2023-11-08T03:58:58.853594Z","published_at":"2017-11-15T19:44:16Z","references":["https://osv.dev/vulnerability/GHSA-7qcx-jmrc-h2rr","https://nvd.nist.gov/vuln/detail/CVE-2017-15878","https://github.com/keystonejs/keystone/pull/4478","https://github.com/advisories/GHSA-7qcx-jmrc-h2rr","https://github.com/keystonejs/keystone","https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html","https://securelayer7.net/download/pdf/KeystoneJS-Pentest-Report-SecureLayer7.pdf","https://www.exploit-db.com/exploits/43054","https://www.npmjs.com/advisories/980","http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report","http://www.securityfocus.com/bid/101541"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-7qcx-jmrc-h2rr","url":"https://osv.dev/vulnerability/GHSA-7qcx-jmrc-h2rr"}],"summary":"Cross-Site Scripting in keystone"}