Cross-Site Scripting in swagger-ui

MEDIOGHSA-22q9-hqm5-mhmc · Published 11/09/2020 · updated 28/09/2021

En resumen

GHSA-22q9-hqm5-mhmc es una vulnerabilidad MEDIO que afecta a swagger-ui.
Solución: actualizar a 2.2.1 o posterior.

Package	Affected versions	Patched versions
swagger-ui npm	`< 2.2.1`	`2.2.1`

Description

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html it may allow attackers to execute arbitrary JavaScript.

Recommendation

Upgrade to version 2.2.1 or later.

References

swagger-api/swagger-ui · WEB
swagger-api/swagger-ui · PACKAGE
npmjs.com/advisories/987 · WEB

Más vulnerabilidades de swagger-ui

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free