MapProxy vulnerable to cross-site scripting in demo service

MEDIUM 6.1CVE-2017-1000426 · GHSA-g4rw-82hq-8jpr · PYSEC-2026-841 · Published 02/01/2018 · updated 17/06/2026

In short

CVE-2017-1000426 is a MEDIUM (CVSS 6.1) vulnerability affecting mapproxy, mapproxy (omniscale).
Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 56.3% of all vulnerabilities.
Fix: update to 1.11.1 or later.

Package	Affected versions	Patched versions
mapproxy PyPI	`< 1.11.1`	`1.11.1`
mapproxy omniscale	`≤ 1.10.3`	No fix yet

Description

MapProxy version 1.11.1 and older are vulnerable to cross-site scripting in the demo service resulting in possible information disclosure. An incomplete fix was released in v1.10.4, and a complete fix was released in v1.11.1.

NVD description

MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000426 · ADVISORY
mapproxy/mapproxy · WEB
mapproxy/mapproxy commit 420412a · WEB
mapproxy/mapproxy commit 436c8f4 · WEB
mapproxy/mapproxy · PACKAGE
pypi.org/project/mapproxy · PACKAGE
GitHub Advisory GHSA-g4rw-82hq-8jpr · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free