Description

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.

Remediation

References

https://community.rapid7.com/community/infosec/blog/2016/09/02/r7-2016-19-persistent-xss-via-unescaped-parameters-in-swagger-ui

Related Vulnerabilities

CVE-2019-10768 Vulnerability in maven package org.webjars.bowergithub.angular:angular

CVE-2020-20739 Vulnerability in npm package libvips

CVE-2018-3717 Vulnerability in npm package anywhere

CVE-2018-17297 Vulnerability in maven package cn.hutool:hutool-core

CVE-2016-10588 Vulnerability in npm package nw

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory