CVE-2019-17495: CSRF
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Other sources
Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. By using the relative path overwrite (RPO) attack technique, an attacker could exploit this vulnerability to obtain sensitive information.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-17495?
CVE-2019-17495 is a Cascading Style Sheets (CSS) injection vulnerability in Swagger UI that could allow a remote attacker to obtain sensitive information.
What is the severity of CVE-2019-17495?
The severity of CVE-2019-17495 is critical with a severity value of 9.8.
How does CVE-2019-17495 allow attackers to obtain sensitive information?
CVE-2019-17495 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value.
Which versions of Swagger UI are affected by CVE-2019-17495?
Swagger UI versions before 3.23.11 are affected by CVE-2019-17495.
How can I fix CVE-2019-17495?
To fix CVE-2019-17495, upgrade Swagger UI to version 3.23.11 or later.