Detections
Analytics

SCA: security update for osm-static-maps (GHSA-pxcf-v868-m492)

high Tenable Self-Hosted Container Security Plugin ID 417768

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - This affects all versions of package osm-static-maps. User input given to the package is passed directly
 to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary
 HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives
 opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local
 File Read. (CVE-2020-7749)

See Also

https://github.com/advisories/GHSA-pxcf-v868-m492

Plugin Details

Severity: High

ID: 417768

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.21

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2020-7749

CVSS v3

Risk Factor: High

Base Score: 7.6

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/10/2021

Vulnerability Publication Date: 10/20/2020

Reference Information

CVE: CVE-2020-7749