Critical severity · published Oct 10, 2019
CVE-2019-17495
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input…
9.8
CVSS
5.7%
EPSS
No
On KEV
Description
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.7% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Banking Apis · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BD
Banking Digital Experience · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BP
Banking Platform · Oracle
2.4.0 through 2.10.0 · source: NVD
PG
Primavera Gateway · Oracle
16.2.0 through 16.2.11; 17.12.0 through 17.12.8 · source: NVD
SU
Swagger UI · Smartbear
before 3.23.11 · source: NVD
UF
Utilities Framework · Oracle
4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17495
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17495
Release Notes
https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
Exploit
https://github.com/tarantula-team/CSS-injection-in-Swagger-UI
lists.apache.org
https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E
More from Banking Apis
8.3
CVE-2021-2351
Vulnerability in the Advanced Networking Option component of Oracle Database Server
8.2
CVE-2020-11987
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel
7.5
CVE-2021-37137
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage
7.5
CVE-2021-37136
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)
7.5
CVE-2021-36090
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability