CVE-2017-1000042
UnknownEPSS 0.93%
Last modified
CVE-2017-1000042 is a vulnerability of currently unknown severity. Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.. EPSS estimates a 0.93% chance of exploitation in the next 30 days.
Description
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mapbox Project | Mapbox | 1.0.0 |
| Mapbox Project | Mapbox | 1.0.1 |
| Mapbox Project | Mapbox | 1.0.2 |
| Mapbox Project | Mapbox | 1.0.3 |
| Mapbox Project | Mapbox | 1.0.4 |
| Mapbox Project | Mapbox | 1.1.0 |
| Mapbox Project | Mapbox | 1.2.0 |
| Mapbox Project | Mapbox | 1.3.0 |
| Mapbox Project | Mapbox | 1.3.1 |
| Mapbox Project | Mapbox | 1.4.0 |
| Mapbox Project | Mapbox | 1.4.1 |
| Mapbox Project | Mapbox | 1.4.2 |
| Mapbox Project | Mapbox | 1.5.0 |
| Mapbox Project | Mapbox | 1.5.1 |
| Mapbox Project | Mapbox | 1.5.2 |
| Mapbox Project | Mapbox | 1.6.0 |
| Mapbox Project | Mapbox | 1.6.1 |
| Mapbox Project | Mapbox | 1.6.2 |
| Mapbox Project | Mapbox | 1.6.4 |
| Mapbox Project | Mapbox | 2.0.0 |
| Mapbox Project | Mapbox | 2.0.1 |
| Mapbox Project | Mapbox | 2.1.0 |
| Mapbox Project | Mapbox | 2.1.1 |
| Mapbox Project | Mapbox | 2.1.2 |
| Mapbox Project | Mapbox | 2.1.3 |
| Mapbox Project | Mapbox | 2.1.4 |
| Mapbox Project | Mapbox | 2.1.5 |
| Mapbox Project | Mapbox | 2.1.6 |
References
- https://hackerone.com/reports/54327Exploit, Third Party Advisory
- https://nodesecurity.io/advisories/49Third Party Advisory
- https://hackerone.com/reports/54327Exploit, Third Party Advisory
- https://nodesecurity.io/advisories/49Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1000042?
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
How severe is CVE-2017-1000042?
Severity scoring for CVE-2017-1000042 is pending analysis. The EPSS model estimates a 0.93% probability of exploitation in the next 30 days.
How do I fix CVE-2017-1000042?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2017-1000042?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST