{"id":"CVE-2020-15500","aliases":["EUVD-2021-0919","GHSA-3fr8-mwpp-8h9p"],"status":"published","title":"Cross-site scripting in TileServer GL","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.12224,"percentile":0.96202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2020-07-01T22:14:44Z","modified":"2026-10-20T10:51:56Z","exploits":[{"source":"exploitdb","id":"EDB-49771","title":"Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)","type":"webapps","platform":"multiple","date":"2021-04-15","url":"https://www.exploit-db.com/exploits/49771"},{"source":"nuclei","id":"CVE-2020-15500","title":"TileServer GL \u003c=3.0.0 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15500.yaml"}],"fixes":[{"ecosystem":"npm","package":"tileserver-gl","fixed_in":["3.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tileserver-gl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"},{"fixed":"3.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"tileserver-gl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}]}],"products":[{"vendor":"tileserver","product":"tileservergl"}],"references":[{"url":"https://github.com/maptiler/tileserver-gl/issues/461","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"http://packetstormsecurity.com/files/162193/Tileserver-gl-3.0.0-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15500","tags":["advisory"]},{"url":"https://github.com/maptiler/tileserver-gl/commit/10431d70d0f0d7b7950ae2c02aea0850c7566621","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3fr8-mwpp-8h9p"},{"url":"https://github.com/maptiler/tileserver-gl","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-15500","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","status":"published","published":"2020-07-01T22:14:44Z","modified":"2024-08-04T13:15:20.717Z","updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2021-0919","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","status":"published","published":"2020-07-01T22:14:44Z","modified":"2024-08-04T13:15:20Z","updated_at":"2026-11-03T03:07:31.508652Z"}],"ghsa":[{"id":"GHSA-3fr8-mwpp-8h9p","title":"Cross-site scripting in TileServer GL","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","status":"published","published":"2021-05-17T21:01:15Z","modified":"2023-10-02T20:24:15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2020-15500","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","status":"published","published":"2020-07-01T23:15:10.333Z","modified":"2026-06-17T02:56:44.873Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-15500","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","status":"published","published":"2020-07-01T23:15:10.333Z","modified":"2026-10-20T10:51:56.885017471Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-3fr8-mwpp-8h9p","title":"Cross-site scripting in TileServer GL","description":"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.","status":"published","published":"2021-05-17T21:01:15Z","modified":"2023-11-08T04:02:37.114856Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}