gsd-2017-1000043
Vulnerability from gsd
Modified
2016-01-12 00:00
Details
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios. If you use L.mapbox.map and L.mapbox.shareControl it is possible for a malicious user with control over the TileJSON content to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js. Such usage is uncommon. L.mapbox.shareControl is not automatically added to Mapbox.js maps and must be explicitly added. The following usage scenarios are not vulnerable: * the map does not use a share control (L.mapbox.sharecontrol) * only trusted TileJSON content is loaded
Aliases
Aliases
CVE-2017-1000043


To clipboard 

{
  "GSD": {
    "alias": "CVE-2017-1000043",
    "description": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control",
    "id": "GSD-2017-1000043"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "mapbox-rails",
            "purl": "pkg:gem/mapbox-rails"
          }
        }
      ],
      "aliases": [
        "CVE-2017-1000043",
        "OSVDB-132871",
        "GHSA-q69p-5h74-w36f"
      ],
      "details": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable\nto a cross-site-scripting attack in certain uncommon usage scenarios.\n\nIf you use L.mapbox.map and L.mapbox.shareControl it is possible for a\nmalicious user with control over the TileJSON content to inject script\ncontent into the name value of the TileJSON. After clicking on the share\ncontrol, the malicious code will execute in the context of the page using\nMapbox.js.\n\nSuch usage is uncommon. L.mapbox.shareControl is not automatically added to\nMapbox.js maps and must be explicitly added. The following usage scenarios\nare not vulnerable:\n\n* the map does not use a share control (L.mapbox.sharecontrol)\n* only trusted TileJSON content is loaded\n",
      "id": "GSD-2017-1000043",
      "modified": "2016-01-12T00:00:00.000Z",
      "published": "2016-01-12T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043"
        },
        {
          "type": "WEB",
          "url": "https://nodesecurity.io/advisories/74"
        },
        {
          "type": "WEB",
          "url": "https://hackerone.com/reports/99245"
        },
        {
          "type": "WEB",
          "url": "https://github.com/advisories/GHSA-q69p-5h74-w36f"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 4.3,
          "type": "CVSS_V2"
        },
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "mapbox-rails Content Injection via TileJSON Name"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "DATE_ASSIGNED": "2017-05-06T20:43:28.291774",
        "ID": "CVE-2017-1000043",
        "REQUESTER": "ulsh@mapbox.com",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://nodesecurity.io/advisories/74",
            "refsource": "CONFIRM",
            "url": "https://nodesecurity.io/advisories/74"
          },
          {
            "name": "https://hackerone.com/reports/99245",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/99245"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2017-1000043",
      "cvss_v2": 4.3,
      "cvss_v3": 6.1,
      "date": "2016-01-12",
      "description": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable\nto a cross-site-scripting attack in certain uncommon usage scenarios.\n\nIf you use L.mapbox.map and L.mapbox.shareControl it is possible for a\nmalicious user with control over the TileJSON content to inject script\ncontent into the name value of the TileJSON. After clicking on the share\ncontrol, the malicious code will execute in the context of the page using\nMapbox.js.\n\nSuch usage is uncommon. L.mapbox.shareControl is not automatically added to\nMapbox.js maps and must be explicitly added. The following usage scenarios\nare not vulnerable:\n\n* the map does not use a share control (L.mapbox.sharecontrol)\n* only trusted TileJSON content is loaded\n",
      "gem": "mapbox-rails",
      "ghsa": "q69p-5h74-w36f",
      "osvdb": 132871,
      "patched_versions": [
        "~\u003e 1.6.6",
        "\u003e= 2.2.4"
      ],
      "related": {
        "url": [
          "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043",
          "https://nodesecurity.io/advisories/74",
          "https://hackerone.com/reports/99245",
          "https://github.com/advisories/GHSA-q69p-5h74-w36f"
        ]
      },
      "title": "mapbox-rails Content Injection via TileJSON Name",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.0.0 \u003c1.6.6||\u003e=2.0.0 \u003c2.2.4",
          "affected_versions": "All versions starting from 1.0.0 before 1.6.6, all versions starting from 2.0.0 before 2.2.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-78",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2023-03-27",
          "description": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 is vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control",
          "fixed_versions": [
            "1.6.6",
            "2.2.4"
          ],
          "identifier": "CVE-2017-1000043",
          "identifiers": [
            "GHSA-q69p-5h74-w36f",
            "CVE-2017-1000043"
          ],
          "not_impacted": "All versions before 1.0.0, all versions starting from 1.6.6 before 2.0.0, all versions starting from 2.2.4",
          "package_slug": "gem/mapbox-rails",
          "pubdate": "2018-11-09",
          "solution": "Upgrade to versions 1.6.6, 2.2.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043",
            "https://hackerone.com/reports/99245",
            "https://github.com/advisories/GHSA-q69p-5h74-w36f",
            "https://www.npmjs.com/advisories/74",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mapbox-rails/CVE-2017-1000043.yml",
            "https://nodesecurity.io/advisories/74"
          ],
          "uuid": "231951fb-9e67-4d40-871e-401f94fa569d"
        },
        {
          "affected_range": "\u003e=1.0.0 \u003c1.6.6||\u003e=2.0.0 \u003c2.2.4",
          "affected_versions": "All versions starting from 1.0.0 before 1.6.6, all versions starting from 2.0.0 before 2.2.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2019-10-31",
          "description": "Mapbox is vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via `TileJSON` name and map share control",
          "fixed_versions": [
            "1.6.6",
            "2.2.4"
          ],
          "identifier": "CVE-2017-1000043",
          "identifiers": [
            "CVE-2017-1000043"
          ],
          "not_impacted": "All versions before 1.0.0, all versions starting from 1.6.6 before 2.0.0, all versions starting from 2.2.4",
          "package_slug": "npm/mapbox.js",
          "pubdate": "2017-07-17",
          "solution": "Upgrade to versions 1.6.6, 2.2.4 or above.",
          "title": "Cross-site Scripting",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043"
          ],
          "uuid": "7410f4bf-576e-4c49-84bc-40f3f41bacbf"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mapbox:mapbox.js:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.6.6",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mapbox:mapbox.js:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.2.4",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-1000043"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodesecurity.io/advisories/74",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://nodesecurity.io/advisories/74"
            },
            {
              "name": "https://hackerone.com/reports/99245",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/99245"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2019-10-31T20:27Z",
      "publishedDate": "2017-07-17T13:18Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.