Skip to content

Content Injection via TileJSON Name in mapbox.js

Moderate severity GitHub Reviewed Published Nov 9, 2018 to the GitHub Advisory Database • Updated Mar 27, 2023

Package

bundler mapbox-rails (RubyGems)

Affected versions

>= 1.0.0, < 1.6.6
>= 2.0.0, < 2.2.4

Patched versions

1.6.6
2.2.4
npm mapbox.js (npm)
< 1.6.6
>= 2.0.0, < 2.2.4
1.6.6
2.2.4

Description

Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If L.mapbox.map or L.mapbox.shareControl are used in a manner that gives users control of the TileJSON content, it is possible to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js.

Recommendation

Version 1.x: Update to version 1.6.6 or later.
Version 2.x: Update to version 2.2.4 or later.

References

Published by the National Vulnerability Database Jul 17, 2017
Published to the GitHub Advisory Database Nov 9, 2018
Reviewed Jun 16, 2020
Last updated Mar 27, 2023

Severity

Moderate
6.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2017-1000043

GHSA ID

GHSA-q69p-5h74-w36f

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.