CVE-2020-7749
High
Description
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
SeverityHigh
CVSS7.6
Exploit probability—
ProductOsm-static-maps
PublishedOct 20, 2020
First seenOct 20, 2020
How to fix
Update
- osm-static-maps3.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| osm-static-maps_project osm-static-maps | No range specified | — |
| osm-static-mapsnpm | v < 3.9.0 | 3.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.