NetSight
IP …
critical9.8

CVE-2019-17495

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perf…

Impact

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Affected products

VendorProductAffected versions
SmartbearSwagger Ui
before 3.23.11
OracleBanking Apis
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Digital Experience
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Platform
from 2.4.0 through 2.10.0
OraclePrimavera Gateway
from 16.2.0 through 16.2.11
from 17.12.0 through 17.12.8
OracleUtilities Framework
Versions 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0

Weakness classification

CWE-352

References