What is GHSA-6494-v9fq-fgq2?

GHSA-6494-v9fq-fgq2 is a security advisory published by GitHub Security Advisories with High severity. Keystone is vulnerable to CSV injection

Which CVE IDs does GHSA-6494-v9fq-fgq2 cover?

GHSA-6494-v9fq-fgq2 covers the following CVE IDs: CVE-2017-15879. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6494-v9fq-fgq2?

GHSA-6494-v9fq-fgq2 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-6494-v9fq-fgq2?

GHSA-6494-v9fq-fgq2 affects 1 product, including: npm/keystone:\u003c= 4.0.0-beta5.

GHSA-6494-v9fq-fgq2HighCVSS 8.8

Keystone is vulnerable to CSV injection

Vendor

GitHub Security Advisories

Published

November 16, 2017

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2017-15879 →

📋 Description

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

🎯 Affected products1

npm/keystone:<= 4.0.0-beta5

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-15879
https://github.com/keystonejs/keystone/pull/4478
https://github.com/advisories/GHSA-6494-v9fq-fgq2
https://packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html
https://www.exploit-db.com/exploits/43053/