GHSA-qr28-7j6p-9hmv

Source

https://github.com/advisories/GHSA-qr28-7j6p-9hmv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-qr28-7j6p-9hmv/GHSA-qr28-7j6p-9hmv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qr28-7j6p-9hmv

Aliases

CVE-2017-1000042

Published

2018-11-09T17:47:45Z

Modified

2023-11-08T03:58:41.962890Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Content Injection via TileJSON attribute in mapbox.js

Details

Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If L.mapbox.map or L.mapbox.tileLayer are used to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious user with control over the TileJSON content to inject script content into the "attribution" value of the TileJSON which will be executed in the context of the page using Mapbox.js.

Recommendation

Version 2.x: Update to version 2.1.7 or later. Version 1.x: Update to version 1.6.5 or later.

Database specific

{
    "nvd_published_at": "2017-07-17T13:18:00Z",
    "github_reviewed_at": "2020-06-16T21:52:39Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

npm / mapbox.js

Package

Name: mapbox.js; View open source insights on deps.dev
Purl: pkg:npm/mapbox.js

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.5

npm / mapbox.js

Package

Name: mapbox.js; View open source insights on deps.dev
Purl: pkg:npm/mapbox.js

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.1.7

RubyGems / mapbox-rails

Package

Name: mapbox-rails
Purl: pkg:gem/mapbox-rails

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.6.5

Affected versions

1.*

1.0.2

1.0.3

1.0.3.1

1.6.1

1.6.1.1

RubyGems / mapbox-rails

Package

Name: mapbox-rails
Purl: pkg:gem/mapbox-rails

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.1.7