PT-2022-12909 · Unknown · Swagger-Ui-Dist

Published 2022-03-11 · Updated 2025-07-29 · CVE-2021-46708

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions swagger-ui-dist versions prior to 4.1.3

Description The issue allows a remote attacker to hijack the clicking action of the victim by persuading them to visit a malicious website, potentially leading to further attacks against the victim.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the swagger-ui-dist package until a patch is applied.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-46708

GHSA-6C9X-MJ3G-H47X

Affected Products

Swagger-Ui-Dist

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-46708 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46708 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6c9x-mj3g-h47x · Vendor Advisory
• https://security.snyk.io/vuln/SNYK-JS-SWAGGERUIDIST-2314884 · Patch
• https://github.com/swagger-api/swagger-ui · Note
• https://t.me/cvenotify/28635 · Telegram Post
• https://t.me/CVEtracker/28680 · Telegram Post
• https://npmjs.com/package/swagger-ui-dist/v/4.1.3 · Note
• https://security.netapp.com/advisory/ntap-20220407-0004 · Note
• https://t.me/cvenotify/47007 · Telegram Post
• https://t.me/cibsecurity/38771 · Telegram Post