CVE-2020-15500

EPSS 12.2%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 12.2%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

01 Jul 2020Published on NVD

15 Apr 2021Public PoC

Weaponization speed

287 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/162193/Tileserver-gl-3.0.0-Cross-Site-Scripting.htmlunverified exploitdbwww.exploit-db.com/exploits/49771unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/162193/Tileserver-gl-3.0.0-Cross-Site-Scripting.html https://github.com/maptiler/tileserver-gl/issues/461