GitHub Advisoryadvisory · npm

GHSA-3fr8-mwpp-8h9p Cross-site scripting in TileServer GL

MEDIUM Published 2021-05-17 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-15500
Ecosystem
npm
Packages
tileserver-gl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-05-11

Affected packages

• npm tileserver-gl: < 3.1.0 → fixed in 3.1.0

Description

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.

Related

Alias · CVE (1)

  • CVE-2020-15500 An issue was discovered in server.js in TileServer GL through 3.0.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References