PT-2019-20079 · Swagger · Swagger-Ui

Published 2019-06-20 · Updated 2019-06-20

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions swagger-ui versions prior to 3.18.0

Description The issue allows attackers to access window.opener for the original page, which can be used for phishing attacks, as it exploits the target=' blank' attribute in anchor tags.

Recommendations Upgrade to version 3.18.0 or later.

Fix

Weakness Enumeration

CWE-1022

Related Identifiers

GHSA-X9P2-FXQ6-2M5F

Affected Products

Swagger-Ui

References · 6

• https://osv.dev/vulnerability/GHSA-x9p2-fxq6-2m5f · Vendor Advisory
• https://github.com/swagger-api/swagger-ui/commit/3f4cae3334fdd492a373f4453bd03a9ebd87becf · Note
• https://github.com/swagger-api/swagger-ui/releases/tag/v3.18.0 · Note
• https://github.com/swagger-api/swagger-ui/pull/4789 · Note
• https://npmjs.com/advisories/975 · Note
• https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449808 · Note