PT-2018-5201 · Omniscale · Mapproxy

Publicado 2018-01-02 · Atualizado 2022-05-13 · CVE-2017-1000426

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MapProxy versions 1.10.3 and older MapProxy versions 1.11.1 and older are not accurate due to the complete fix being released in v1.11.1, so the correct range is MapProxy versions prior to 1.11.1

Corrected to: MapProxy versions prior to 1.11.1

Description The issue is related to a Cross Site Scripting attack in the demo service, which can result in possible information disclosure.

Recommendations For MapProxy versions prior to 1.10.4, update to version 1.10.4 or later for an incomplete fix. For MapProxy versions 1.10.4 and prior to 1.11.1, update to version 1.11.1 for a complete fix. At the moment, there is no information about additional mitigation measures.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1000426

GHSA-G4RW-82HQ-8JPR

Produtos afetados

Mapproxy

Referências · 12

• 🔥 https://github.com/mapproxy/mapproxy/issues/322 · Exploit
• https://github.com/mapproxy/mapproxy · Nota
• https://github.com/mapproxy/mapproxy/commit/420412aad45171e05752007a0a2350c03c28dfd8 · Nota
• https://github.com/mapproxy/mapproxy/commit/436c8f489761d1b4ee22b2440b53cc96bbc28aea · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000426 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000426 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-1000426 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000426 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-1000426 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-1000426 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000426 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-g4rw-82hq-8jpr · Aviso do Fabricante