Lucene search

MitreCVE-2017-1000042

HistoryJul 17, 2017 - 1:18 p.m.

CVE-2017-1000042

2017-07-1713:18:17

CWE-79

mitre

web.nvd.nist.gov

mapbox.js

cross-site scripting

cve-2017-1000042

security vulnerability

tilejson name

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

33.1%

JSON

Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.

Affected configurations

Nvd

Node

mapbox_projectmapboxMatch1.0.0

mapbox_projectmapboxMatch1.0.1

mapbox_projectmapboxMatch1.0.2

mapbox_projectmapboxMatch1.0.3

mapbox_projectmapboxMatch1.0.4

mapbox_projectmapboxMatch1.1.0

mapbox_projectmapboxMatch1.2.0

mapbox_projectmapboxMatch1.3.0

mapbox_projectmapboxMatch1.3.1

mapbox_projectmapboxMatch1.4.0

mapbox_projectmapboxMatch1.4.1

mapbox_projectmapboxMatch1.4.2

mapbox_projectmapboxMatch1.5.0

mapbox_projectmapboxMatch1.5.1

mapbox_projectmapboxMatch1.5.2

mapbox_projectmapboxMatch1.6.0

mapbox_projectmapboxMatch1.6.0beta

mapbox_projectmapboxMatch1.6.0beta0

mapbox_projectmapboxMatch1.6.1

mapbox_projectmapboxMatch1.6.2

mapbox_projectmapboxMatch1.6.2beta0

mapbox_projectmapboxMatch1.6.4

mapbox_projectmapboxMatch2.0.0

mapbox_projectmapboxMatch2.0.0beta0

mapbox_projectmapboxMatch2.0.0beta1

mapbox_projectmapboxMatch2.0.1

mapbox_projectmapboxMatch2.1.0

mapbox_projectmapboxMatch2.1.1

mapbox_projectmapboxMatch2.1.2

mapbox_projectmapboxMatch2.1.3

mapbox_projectmapboxMatch2.1.4

mapbox_projectmapboxMatch2.1.5

mapbox_projectmapboxMatch2.1.6

VendorProductVersionCPE
mapbox_projectmapbox1.0.0cpe:2.3:a:mapbox_project:mapbox:1.0.0:*:*:*:*:*:*:*
mapbox_projectmapbox1.0.1cpe:2.3:a:mapbox_project:mapbox:1.0.1:*:*:*:*:*:*:*
mapbox_projectmapbox1.0.2cpe:2.3:a:mapbox_project:mapbox:1.0.2:*:*:*:*:*:*:*
mapbox_projectmapbox1.0.3cpe:2.3:a:mapbox_project:mapbox:1.0.3:*:*:*:*:*:*:*
mapbox_projectmapbox1.0.4cpe:2.3:a:mapbox_project:mapbox:1.0.4:*:*:*:*:*:*:*
mapbox_projectmapbox1.1.0cpe:2.3:a:mapbox_project:mapbox:1.1.0:*:*:*:*:*:*:*
mapbox_projectmapbox1.2.0cpe:2.3:a:mapbox_project:mapbox:1.2.0:*:*:*:*:*:*:*
mapbox_projectmapbox1.3.0cpe:2.3:a:mapbox_project:mapbox:1.3.0:*:*:*:*:*:*:*
mapbox_projectmapbox1.3.1cpe:2.3:a:mapbox_project:mapbox:1.3.1:*:*:*:*:*:*:*
mapbox_projectmapbox1.4.0cpe:2.3:a:mapbox_project:mapbox:1.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mapbox_project	mapbox	1.0.0	cpe:2.3:a:mapbox_project:mapbox:1.0.0:::::::*
mapbox_project	mapbox	1.0.1	cpe:2.3:a:mapbox_project:mapbox:1.0.1:::::::*
mapbox_project	mapbox	1.0.2	cpe:2.3:a:mapbox_project:mapbox:1.0.2:::::::*
mapbox_project	mapbox	1.0.3	cpe:2.3:a:mapbox_project:mapbox:1.0.3:::::::*
mapbox_project	mapbox	1.0.4	cpe:2.3:a:mapbox_project:mapbox:1.0.4:::::::*
mapbox_project	mapbox	1.1.0	cpe:2.3:a:mapbox_project:mapbox:1.1.0:::::::*
mapbox_project	mapbox	1.2.0	cpe:2.3:a:mapbox_project:mapbox:1.2.0:::::::*
mapbox_project	mapbox	1.3.0	cpe:2.3:a:mapbox_project:mapbox:1.3.0:::::::*
mapbox_project	mapbox	1.3.1	cpe:2.3:a:mapbox_project:mapbox:1.3.1:::::::*
mapbox_project	mapbox	1.4.0	cpe:2.3:a:mapbox_project:mapbox:1.4.0:::::::*

Rows per page:

1-10 of 331

References

hackerone.com/reports/54327

nodesecurity.io/advisories/49

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

33.1%

JSON

Related for CVE-2017-1000042