Cross-site scripting in Swagger-UI

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value.

Recommendation

Update the swagger-ui package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.23.11
• Patched version(s): 3.23.11

References

• GHSA-c427-hjc3-wrfw
• www.oracle.com
• lists.apache.org
• security.snyk.io
• CVE-2019-17495
• CWE-352
• CWE-79
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6