GHSA-3fr8-mwpp-8h9p

Cross-site scripting in TileServer GL

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15500

Packages

Ecosystem	Package	Affected	Fixed in
npm	tileserver-gl	< 3.1.0	3.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-15500 advisory
https://github.com/maptiler/tileserver-gl/issues/461 web
https://github.com/maptiler/tileserver-gl/commit/10431d70d0f0d7b7950ae2c02aea0850c7566621 web
https://github.com/maptiler/tileserver-gl package
http://packetstormsecurity.com/files/162193/Tileserver-gl-3.0.0-Cross-Site-Scripting.html web