PT-2019-20079 · Swagger · Swagger-Ui

Publicado 2019-06-20 · Atualizado 2019-06-20

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions swagger-ui versions prior to 3.18.0

Description The issue allows attackers to access window.opener for the original page, which can be used for phishing attacks, as it exploits the target=' blank' attribute in anchor tags.

Recommendations Upgrade to version 3.18.0 or later.

Correção

Enumeração de Fraquezas

CWE-1022

Identificadores relacionados

GHSA-X9P2-FXQ6-2M5F

Produtos afetados

Swagger-Ui

Referências · 6

• https://github.com/swagger-api/swagger-ui/commit/3f4cae3334fdd492a373f4453bd03a9ebd87becf · Nota
• https://github.com/swagger-api/swagger-ui/releases/tag/v3.18.0 · Nota
• https://github.com/swagger-api/swagger-ui/pull/4789 · Nota
• https://npmjs.com/advisories/975 · Nota
• https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449808 · Nota
• https://osv.dev/vulnerability/GHSA-x9p2-fxq6-2m5f · Aviso do Fabricante