Description

Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control

Remediation

References

https://hackerone.com/reports/99245

https://nodesecurity.io/advisories/74

Related Vulnerabilities

CVE-2020-7787 Vulnerability in npm package react-adal

CVE-2023-46652 Vulnerability in maven package org.jenkins-ci.plugins:lambdatest-automation

CVE-2022-36899 Vulnerability in maven package com.compuware.jenkins:compuware-ispw-operations

CVE-2018-3746 Vulnerability in npm package pdfinfojs

CVE-2017-16198 Vulnerability in npm package ritp

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory