Description

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.

Remediation

References

https://github.com/maptiler/tileserver-gl/issues/461

http://packetstormsecurity.com/files/162193/Tileserver-gl-3.0.0-Cross-Site-Scripting.html

Related Vulnerabilities

CVE-2021-37713 Vulnerability in npm package tar

CVE-2020-15999 Vulnerability in npm package electron

CVE-2021-37533 Vulnerability in maven package commons-net:commons-net

CVE-2021-43787 Vulnerability in npm package nodebb

CVE-2020-8237 Vulnerability in maven package org.webjars.npm:json-bigint

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory VDB Entry