CVE-2024-35627
published 2024-05-22CVE-2024-35627: tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
PriorityP335medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
0.96%
57.0th percentile
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
TileServer API - Cross Site Scripting
nuclei·CVSS 6.1
CVE-2024-35627 [MEDIUM] TileServer API - Cross Site Scripting
TileServer API - Cross Site Scripting
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
Template:
id: CVE-2024-35627
info:
name: TileServer API - Cross Site Scripting
author: DhiyaneshDK
severity: medium
description: |
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
impact: |
Attackers can inject malicious scripts via the key parameter, potentially compromising user sessions or stealing sensitive information.
remediation: |
Update tileserver-gl to a version later than v4.4.10 that patches the XSS vulnerability.
reference:
- https://gist.github.com/SaleSlave/e23d49e7f8eb937784d15c2c2fc34fca
classification:
cvss-metrics: CVSS:3.
2024-05-22
Published