GHSA-g4rw-82hq-8jpr

MapProxy vulnerable to cross-site scripting in demo service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000426

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	MapProxy	< 1.11.1	1.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

MapProxy version 1.11.1 and older are vulnerable to cross-site scripting in the demo service resulting in possible information disclosure. An incomplete fix was released in v[1.10.4](https://github.com/mapproxy/mapproxy/issues/322#issuecomment-518573169), and a complete fix was released in v[1.11.1](https://github.com/mapproxy/mapproxy/commit/436c8f489761d1b4ee22b2440b53cc96bbc28aea).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000426 advisory
https://github.com/mapproxy/mapproxy/issues/322 web
https://github.com/mapproxy/mapproxy/commit/420412aad45171e05752007a0a2350c03c28dfd8 web
https://github.com/mapproxy/mapproxy/commit/436c8f489761d1b4ee22b2440b53cc96bbc28aea web
https://github.com/mapproxy/mapproxy package