CVE-2019-17495

Summary

CVE	CVE-2019-17495
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-10-10 22:15:00 UTC
Updated	2023-11-07 03:06:00 UTC
Description	A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Risk And Classification

Problem Types: CWE-352

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Oracle	Banking Apis	19.1	All	All	All
Application	Oracle	Banking Apis	19.2	All	All	All
Application	Oracle	Banking Apis	20.1	All	All	All
Application	Oracle	Banking Apis	21.1	All	All	All
Application	Oracle	Banking Apis	All	All	All	All
Application	Oracle	Banking Digital Experience	19.1	All	All	All
Application	Oracle	Banking Digital Experience	19.2	All	All	All
Application	Oracle	Banking Digital Experience	20.1	All	All	All
Application	Oracle	Banking Digital Experience	21.1	All	All	All
Application	Oracle	Banking Digital Experience	All	All	All	All
Application	Oracle	Banking Platform	All	All	All	All
Application	Oracle	Primavera Gateway	All	All	All	All
Application	Oracle	Primavera Gateway	All	All	All	All
Application	Oracle	Utilities Framework	4.3.0.6.0	All	All	All
Application	Oracle	Utilities Framework	4.4.0.0.0	All	All	All
Application	Oracle	Utilities Framework	4.4.0.2.0	All	All	All
Application	Smartbear	Swagger Ui	All	All	All	All
Application	Smartbear	Swagger Ui	All	All	All	All

References

Reference	Source	Link	Tags
Pony Mail!	MLIST	lists.apache.org
[airflow-commits] 20210920 [GitHub] [airflow] boring-cyborg[bot] commented on issue #18383: CVE-2019-17495 for swagger-ui		lists.apache.org
Pony Mail!	MLIST	lists.apache.org
GitHub - tarantula-team/CSS-injection-in-Swagger-UI: CSS injection vulnerability in Swagger UI	MISC	github.com	Exploit, Third Party Advisory
Oracle Critical Patch Update Advisory - October 2020	MISC	www.oracle.com
Pony Mail!	MLIST	lists.apache.org
Oracle Critical Patch Update Advisory - January 2022	MISC	www.oracle.com
[airflow-commits] 20210920 [GitHub] [airflow] uranusjr commented on issue #18383: CVE-2019-17495 for swagger-ui		lists.apache.org
[airflow-commits] 20210921 [GitHub] [airflow] beltran-rubo commented on issue #18383: CVE-2019-17495 for swagger-ui		lists.apache.org
Pony Mail!	MLIST	lists.apache.org
[airflow-commits] 20210921 [GitHub] [airflow] beltran-rubo closed issue #18383: CVE-2019-17495 for swagger-ui		lists.apache.org
Pony Mail!	MLIST	lists.apache.org
[airflow-commits] 20210920 [GitHub] [airflow] beltran-rubo opened a new issue #18383: CVE-2019-17495 for swagger-ui		lists.apache.org
Release Swagger UI 3.23.11 Released! · swagger-api/swagger-ui · GitHub	MISC	github.com	Release Notes
Oracle Critical Patch Update Advisory - July 2022	N/A	www.oracle.com
Oracle Critical Patch Update Advisory - April 2021	MISC	www.oracle.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

980819 Nodejs (npm) Security Update for swagger-ui (GHSA-c427-hjc3-wrfw)