CVE-2020-7749
Summary
| CVE | CVE-2020-7749 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-10-20 11:15:00 UTC |
| Updated | 2021-07-21 11:39:00 UTC |
| Description | This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read. |
Risk And Classification
Problem Types: CWE-79 | CWE-74
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Osm-static-maps Project | Osm-static-maps | All | All | All | All |
| Application | Osm-static-maps Project | Osm-static-maps | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Server-side Request Forgery (SSRF) in osm-static-maps | Snyk | MISC | snyk.io | Exploit, Third Party Advisory |
| fix: escape special characters before insertion to template by snoopysecurity · Pull Request #24 · jperelli/osm-static-maps · GitHub | MISC | github.com | Patch, Third Party Advisory |
| github.com/jperelli/osm-static-maps/blob/master/src/template.html%23L142 | MISC | github.com | Broken Link |
| osm-static-maps/template.html at master · jperelli/osm-static-maps · GitHub | MITRE | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Vasilii Ermilov
Legacy QID Mappings
- 981834 Nodejs (npm) Security Update for osm-static-maps (GHSA-pxcf-v868-m492)