Content Injection via TileJSON attribute in mapbox.js

🗓️ 09 Nov 2018 17:47:45Reported by GitHub Advisory DatabaseType

Content Injection via TileJSON attribute in mapbox.js. Vulnerable versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 to cross-site-scripting attack when loading untrusted TileJSON content from non-Mapbox URL

Reporter	Title	Published	Views	Family All 12
CNVD	Mapbox.js Cross-Site Scripting Vulnerability	1 Aug 201700:00	–	cnvd
CVE	CVE-2017-1000042	13 Jul 201720:00	–	cve
Cvelist	CVE-2017-1000042	13 Jul 201720:00	–	cvelist
EUVD	EUVD-2018-0771	7 Oct 202500:30	–	euvd
Hacker One	Mapbox: Persistent cross-site scripting (XSS) in map attribution	2 Apr 201500:56	–	hackerone
Node.js	Content Injection via TileJSON attribute	24 Oct 201518:05	–	nodejs
NVD	CVE-2017-1000042	17 Jul 201713:18	–	nvd
OSV	CVE-2017-1000042	17 Jul 201713:18	–	osv
OSV	GHSA-QR28-7J6P-9HMV Content Injection via TileJSON attribute in mapbox.js	9 Nov 201817:47	–	osv
Prion	Cross site scripting	17 Jul 201713:18	–	prion

Vulners

Node

mapbox-railsRange2.0.0–2.1.7rubygems

mapbox-railsRange1.0.0–1.6.5rubygems

mapbox mapbox.jsRange2.0.0–2.1.7npm

mapbox mapbox.jsRange<1.6.5npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-1000042
hackerone	www.hackerone.com/reports/54327
github	www.github.com/advisories/GHSA-qr28-7j6p-9hmv
npmjs	www.npmjs.com/advisories/49
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/mapbox-rails/CVE-2017-1000042.yml
nodesecurity	www.nodesecurity.io/advisories/49

27 Mar 2023 22:21Current

3.2Low risk

Vulners AI Score3.2

CVSS 24.3

CVSS 36.1

EPSS0.00164

CWE-79