PT-2018-5201 · Omniscale · Mapproxy

Published 2018-01-02 · Updated 2022-05-13 · CVE-2017-1000426

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MapProxy versions 1.10.3 and older MapProxy versions 1.11.1 and older are not accurate due to the complete fix being released in v1.11.1, so the correct range is MapProxy versions prior to 1.11.1

Corrected to: MapProxy versions prior to 1.11.1

Description The issue is related to a Cross Site Scripting attack in the demo service, which can result in possible information disclosure.

Recommendations For MapProxy versions prior to 1.10.4, update to version 1.10.4 or later for an incomplete fix. For MapProxy versions 1.10.4 and prior to 1.11.1, update to version 1.11.1 for a complete fix. At the moment, there is no information about additional mitigation measures.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000426

GHSA-G4RW-82HQ-8JPR

Affected Products

Mapproxy

References · 12

• 🔥 https://github.com/mapproxy/mapproxy/issues/322 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000426 · Security Note
• https://ubuntu.com/security/CVE-2017-1000426 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000426 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-1000426 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-1000426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000426 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4rw-82hq-8jpr · Vendor Advisory
• https://github.com/mapproxy/mapproxy · Note
• https://github.com/mapproxy/mapproxy/commit/420412aad45171e05752007a0a2350c03c28dfd8 · Note
• https://github.com/mapproxy/mapproxy/commit/436c8f489761d1b4ee22b2440b53cc96bbc28aea · Note