Skip to content

swagger-ui-2.2.10.tgz: 5 vulnerabilities (highest severity is: 9.8) unreachable #12

New issue
New issue
Open
Open
swagger-ui-2.2.10.tgz: 5 vulnerabilities (highest severity is: 9.8) unreachable#12
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend
@mend-for-git.colasdn.top

Description

@mend-for-git.colasdn.top
mend-for-git.colasdn.top
bot
opened on Jul 26, 2024
Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui/package.json

Found in HEAD commit: 54f4ec10f11c47d2b4050fa804f9d9937154abf7

Vulnerabilities

Vulnerability Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (swagger-ui version) Remediation Possible** Reachability
CVE-2019-17495 Critical 9.8 Not Defined 13.7% swagger-ui-2.2.10.tgz Direct 3.23.11 ✅

Unreachable
WS-2019-0172 Medium 6.5 Not Defined swagger-ui-2.2.10.tgz Direct 3.20.9 ✅

Unreachable
WS-2019-0236 Medium 6.1 Not Defined swagger-ui-2.2.10.tgz Direct N/A ❌

Unreachable
WS-2019-0171 Medium 4.3 Not Defined swagger-ui-2.2.10.tgz Direct N/A ❌

Unreachable
CVE-2018-25031 Medium 4.3 Not Defined 83.600006% swagger-ui-2.2.10.tgz Direct 4.1.3 ✅

Unreachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-17495

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui/package.json

Dependency Hierarchy:

  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 54f4ec10f11c47d2b4050fa804f9d9937154abf7

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Publish Date: 2019-10-10

URL: CVE-2019-17495

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 13.7%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/maven/io.springfox/springfox-swagger-ui/CVE-2019-17495.yml

Release Date: 2019-10-10

Fix Resolution: 3.23.11

⛑️ Automatic Remediation will be attempted for this issue.

WS-2019-0172

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui/package.json

Dependency Hierarchy:

  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 54f4ec10f11c47d2b4050fa804f9d9937154abf7

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting

Publish Date: 2019-02-23

URL: WS-2019-0172

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/976

Release Date: 2019-02-23

Fix Resolution: 3.20.9

⛑️ Automatic Remediation will be attempted for this issue.

WS-2019-0236

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui/package.json

Dependency Hierarchy:

  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 54f4ec10f11c47d2b4050fa804f9d9937154abf7

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

swagger-ui versions before 3.0.13 are vulnerable to XSS when it fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.

Publish Date: 2017-06-02

URL: WS-2019-0236

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

WS-2019-0171

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui/package.json

Dependency Hierarchy:

  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 54f4ec10f11c47d2b4050fa804f9d9937154abf7

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

swagger-ui before 3.18.0 has Reverse Tabnapping vulnerability. using target='_blank' in anchor tags, allowing attackers to access window.opener for the original page.

Publish Date: 2018-08-02

URL: WS-2019-0171

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2018-25031

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui/package.json

Dependency Hierarchy:

  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 54f4ec10f11c47d2b4050fa804f9d9937154abf7

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others. Converted from WS-2021-0461, on 2022-12-21.

Publish Date: 2022-03-11

URL: CVE-2018-25031

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 83.600006%

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qrmm-w75w-3wpx

Release Date: 2022-03-11

Fix Resolution: 4.1.3

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions