PT-2020-7934 · Unknown · Swagger-Ui
Published
2020-09-01
·
Updated
2020-09-01
·
CVE-2016-1000226
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
swagger-ui versions prior to 2.2.1
Description:
The issue concerns cross-site scripting in the
consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON documents via the query string parameter url, enabling an attacker to exploit this attack against any user that visits a crafted link, such as "/swagger-ui/index.html?url=http:///malicious-swagger-file.json".Recommendations:
Update to version 2.2.1 or later.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Swagger-Ui