PT-2020-7939 · Unknown · Swagger-Ui

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000233

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: swagger-ui versions prior to 2.2.1

Description: The issue exists due to the automatic execution of external Javascript loaded via the url query string parameter when a Content-Type: application/javascript header is included. An attacker can create a malicious script and craft a URL that includes the location to their server/script in the url query string parameter, allowing the execution of the malicious script when the link is viewed.

Recommendations: Update to version 2.2.1 or later.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-1000233

GHSA-MRX7-8HXF-F853

Affected Products

Swagger-Ui

References · 6

• https://osv.dev/vulnerability/GHSA-mrx7-8hxf-f853 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000233 · Security Note
• https://github.com/swagger-api/swagger-ui · Note
• https://github.com/swagger-api/swagger-ui/commit/331d2be070d89162aa3174a8773ae4a0093f78bc · Note
• https://github.com/swagger-api/swagger-ui/issues/1863 · Note
• https://npmjs.com/advisories/131 · Note