What is GHSA-3fr8-mwpp-8h9p?

GHSA-3fr8-mwpp-8h9p is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting in TileServer GL

Which CVE IDs does GHSA-3fr8-mwpp-8h9p cover?

GHSA-3fr8-mwpp-8h9p covers the following CVE IDs: CVE-2020-15500. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3fr8-mwpp-8h9p?

GHSA-3fr8-mwpp-8h9p has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-3fr8-mwpp-8h9p?

GHSA-3fr8-mwpp-8h9p affects 1 product, including: npm/tileserver-gl:\u003c= 3.0.0.

GHSA-3fr8-mwpp-8h9pMediumCVSS 6.1

Cross-site scripting in TileServer GL

Vendor

GitHub Security Advisories

Published

May 17, 2021

Last Modified

October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-15500 →

📋 Description

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.

🎯 Affected products1

npm/tileserver-gl:<= 3.0.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-15500
https://github.com/maptiler/tileserver-gl/issues/461
http://packetstormsecurity.com/files/162193/Tileserver-gl-3.0.0-Cross-Site-Scripting.html
https://github.com/maptiler/tileserver-gl/commit/10431d70d0f0d7b7950ae2c02aea0850c7566621
https://github.com/advisories/GHSA-3fr8-mwpp-8h9p