Spoofing attack in swagger-ui-dist

Description

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.

Recommendation

Update the swagger-ui-dist package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.1.3
• Patched version(s): 4.1.3

References

• GHSA-6c9x-mj3g-h47x
• security.snyk.io
• www.npmjs.com
• security.netapp.com
• CVE-2021-46708
• CWE-1021
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Spoofing attack in swagger-ui - CVE-2018-25031
• Padding Oracle Attack due to Observable Timing Discrepancy in jose - CVE-2021-29443
• Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime - CVE-2021-29445
• Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime - CVE-2021-29446

Tags:

npm

swagger-ui-dist