swagger-ui-standalone-preset-3.19.3.js: 3 vulnerabilities (highest severity is: 9.8) #2

Vulnerable Library - swagger-ui-standalone-preset-3.19.3.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/3.19.3/swagger-ui-standalone-preset.js

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

CVE-2019-17495

Vulnerable Library - swagger-ui-standalone-preset-3.19.3.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/3.19.3/swagger-ui-standalone-preset.js

Dependency Hierarchy:

• ❌ swagger-ui-standalone-preset-3.19.3.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@⁠import within the JSON data was a functional attack method.

Publish Date: 2019-10-10

URL: CVE-2019-17495

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-c427-hjc3-wrfw

Release Date: 2019-10-10

Fix Resolution: swagger-ui - 3.23.11

WS-2019-0172

Vulnerable Library - swagger-ui-standalone-preset-3.19.3.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/3.19.3/swagger-ui-standalone-preset.js

Dependency Hierarchy:

• ❌ swagger-ui-standalone-preset-3.19.3.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting

Publish Date: 2026-05-27

URL: WS-2019-0172

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

CVE-2018-25031

Vulnerable Library - swagger-ui-standalone-preset-3.19.3.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/3.19.3/swagger-ui-standalone-preset.js

Dependency Hierarchy:

• ❌ swagger-ui-standalone-preset-3.19.3.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

Publish Date: 2022-03-11

URL: CVE-2018-25031

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-cr3q-pqgq-m8c2

Release Date: 2022-03-11

Fix Resolution: swagger-ui - 4.1.3