CVE Feed

    Dashboard / CVE / CVE-2019-17495

    CVE-2019-17495

    A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

    Published:Oct 10, 2019
    Last Modified:Nov 21, 2024
    EPS:Oct 10, 2019
    EPSS Score:0.13709
    CVSS Score:9.8

    Affected Products

    Vendor
    Oracle
    Product
    Banking Apis
    Vendor
    Oracle
    Product
    Banking Digital Experience
    Vendor
    Oracle
    Product
    Banking Platform
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Utilities Framework
    Vendor
    Smartbear
    Product
    Swagger Ui

    Exploits

    https://github.com/tarantula-team/CSS-injection-in-Swagger-UIhttps://github.com/tarantula-team/CSS-injection-in-Swagger-UIhttps://github.com/SecT0uch/CVE-2019-17495-test

    Related CVEs

    CVE-2021-41165 (CVSS 8.2) — CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in th…
    CVE-2021-41164 (CVSS 8.2) — CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in t…
    CVE-2021-37137 (CVSS 7.5) — The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. …
    CVE-2021-37136 (CVSS 7.5) — The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output da…
    CVE-2021-2351 (CVSS 8.3) — Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that a…
    CVE-2021-36090 (CVSS 7.5) — When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that fi…
    CVE-2021-35517 (CVSS 7.5) — When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that fi…
    CVE-2021-29425 (CVSS 4.8) — In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input strin…
    CVE-2021-28163 (CVSS 2.7) — In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapp…
    CVE-2021-28164 (CVSS 5.3) — In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs t…

    References

    https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
    https://github.com/tarantula-team/CSS-injection-in-Swagger-UI
    https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
    https://github.com/tarantula-team/CSS-injection-in-Swagger-UI
    https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2020.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High