Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.springfox:springfox-swagger-ui

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3MavenAmendedPublished

    Cross-site scripting in Swagger-UI

    CVE-2019-17495 · GHSA-c427-hjc3-wrfw

    Affected
    • Maven io.springfox:springfox-swagger-ui < 2.10.0
    Fixed in
    2.10.0· Vendor fix available
    Issue
    A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style@import within the JSON data was a functional attack method.

    Recommended action: Upgrade to 2.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →