{
  "GSD": {
    "alias": "CVE-2017-1000043",
    "description": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control",
    "id": "GSD-2017-1000043"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "mapbox-rails",
            "purl": "pkg:gem/mapbox-rails"
          }
        }
      ],
      "aliases": [
        "CVE-2017-1000043",
        "OSVDB-132871",
        "GHSA-q69p-5h74-w36f"
      ],
      "details": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable\nto a cross-site-scripting attack in certain uncommon usage scenarios.\n\nIf you use L.mapbox.map and L.mapbox.shareControl it is possible for a\nmalicious user with control over the TileJSON content to inject script\ncontent into the name value of the TileJSON. After clicking on the share\ncontrol, the malicious code will execute in the context of the page using\nMapbox.js.\n\nSuch usage is uncommon. L.mapbox.shareControl is not automatically added to\nMapbox.js maps and must be explicitly added. The following usage scenarios\nare not vulnerable:\n\n* the map does not use a share control (L.mapbox.sharecontrol)\n* only trusted TileJSON content is loaded\n",
      "id": "GSD-2017-1000043",
      "modified": "2016-01-12T00:00:00.000Z",
      "published": "2016-01-12T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043"
        },
        {
          "type": "WEB",
          "url": "https://nodesecurity.io/advisories/74"
        },
        {
          "type": "WEB",
          "url": "https://hackerone.com/reports/99245"
        },
        {
          "type": "WEB",
          "url": "https://github.com/advisories/GHSA-q69p-5h74-w36f"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 4.3,
          "type": "CVSS_V2"
        },
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "mapbox-rails Content Injection via TileJSON Name"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "DATE_ASSIGNED": "2017-05-06T20:43:28.291774",
        "ID": "CVE-2017-1000043",
        "REQUESTER": "ulsh@mapbox.com",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://nodesecurity.io/advisories/74",
            "refsource": "CONFIRM",
            "url": "https://nodesecurity.io/advisories/74"
          },
          {
            "name": "https://hackerone.com/reports/99245",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/99245"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2017-1000043",
      "cvss_v2": 4.3,
      "cvss_v3": 6.1,
      "date": "2016-01-12",
      "description": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable\nto a cross-site-scripting attack in certain uncommon usage scenarios.\n\nIf you use L.mapbox.map and L.mapbox.shareControl it is possible for a\nmalicious user with control over the TileJSON content to inject script\ncontent into the name value of the TileJSON. After clicking on the share\ncontrol, the malicious code will execute in the context of the page using\nMapbox.js.\n\nSuch usage is uncommon. L.mapbox.shareControl is not automatically added to\nMapbox.js maps and must be explicitly added. The following usage scenarios\nare not vulnerable:\n\n* the map does not use a share control (L.mapbox.sharecontrol)\n* only trusted TileJSON content is loaded\n",
      "gem": "mapbox-rails",
      "ghsa": "q69p-5h74-w36f",
      "osvdb": 132871,
      "patched_versions": [
        "~\u003e 1.6.6",
        "\u003e= 2.2.4"
      ],
      "related": {
        "url": [
          "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043",
          "https://nodesecurity.io/advisories/74",
          "https://hackerone.com/reports/99245",
          "https://github.com/advisories/GHSA-q69p-5h74-w36f"
        ]
      },
      "title": "mapbox-rails Content Injection via TileJSON Name",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.0.0 \u003c1.6.6||\u003e=2.0.0 \u003c2.2.4",
          "affected_versions": "All versions starting from 1.0.0 before 1.6.6, all versions starting from 2.0.0 before 2.2.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-78",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2023-03-27",
          "description": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 is vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control",
          "fixed_versions": [
            "1.6.6",
            "2.2.4"
          ],
          "identifier": "CVE-2017-1000043",
          "identifiers": [
            "GHSA-q69p-5h74-w36f",
            "CVE-2017-1000043"
          ],
          "not_impacted": "All versions before 1.0.0, all versions starting from 1.6.6 before 2.0.0, all versions starting from 2.2.4",
          "package_slug": "gem/mapbox-rails",
          "pubdate": "2018-11-09",
          "solution": "Upgrade to versions 1.6.6, 2.2.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043",
            "https://hackerone.com/reports/99245",
            "https://github.com/advisories/GHSA-q69p-5h74-w36f",
            "https://www.npmjs.com/advisories/74",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mapbox-rails/CVE-2017-1000043.yml",
            "https://nodesecurity.io/advisories/74"
          ],
          "uuid": "231951fb-9e67-4d40-871e-401f94fa569d"
        },
        {
          "affected_range": "\u003e=1.0.0 \u003c1.6.6||\u003e=2.0.0 \u003c2.2.4",
          "affected_versions": "All versions starting from 1.0.0 before 1.6.6, all versions starting from 2.0.0 before 2.2.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2019-10-31",
          "description": "Mapbox is vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via `TileJSON` name and map share control",
          "fixed_versions": [
            "1.6.6",
            "2.2.4"
          ],
          "identifier": "CVE-2017-1000043",
          "identifiers": [
            "CVE-2017-1000043"
          ],
          "not_impacted": "All versions before 1.0.0, all versions starting from 1.6.6 before 2.0.0, all versions starting from 2.2.4",
          "package_slug": "npm/mapbox.js",
          "pubdate": "2017-07-17",
          "solution": "Upgrade to versions 1.6.6, 2.2.4 or above.",
          "title": "Cross-site Scripting",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-1000043"
          ],
          "uuid": "7410f4bf-576e-4c49-84bc-40f3f41bacbf"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mapbox:mapbox.js:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.6.6",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mapbox:mapbox.js:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.2.4",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-1000043"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodesecurity.io/advisories/74",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://nodesecurity.io/advisories/74"
            },
            {
              "name": "https://hackerone.com/reports/99245",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/99245"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2019-10-31T20:27Z",
      "publishedDate": "2017-07-17T13:18Z"
    }
  }
}