CVE-2019-17495 json
Cross-site scripting in Swagger-UI
published 2019-10-10 7 y ago modified 2026-06-17 4 mo ago also GHSA-c427-hjc3-wrfw , EUVD-2019-0696
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.7%
- EPSS 5.7% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Patch / fix
- npm swagger-ui 3.23.11
- maven org.webjars:swagger-ui 3.23.11
- maven org.webjars.npm:swagger-ui 3.23.11
- maven io.springfox:springfox-swagger-ui 2.10.0
- smartbear swagger_ui 3.23.11
Exploit prediction
5.73% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/tarantula-team/CSS-injection-in-Swagger-UI referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | swagger-ui | <3.23.11 |
3.23.11 |
| maven | org.webjars:swagger-ui | <3.23.11 |
3.23.11 |
| maven | org.webjars.npm:swagger-ui | <3.23.11 |
3.23.11 |
| maven | io.springfox:springfox-swagger-ui | <2.10.0 |
2.10.0 |
Classification
References
-
oracle.com
/security-alerts/cpuoct2020.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuApr2021.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory
-
github.com
/springfox/springfox/commit/26f72f0d16b166e12c20255a4ee907dc10685cf8
web
-
github.com
/tarantula-team/CSS-injection-in-Swagger-UI
web, exploit, third-party-advisory
-
github.com
/swagger-api/swagger-ui/releases/tag/v3.23.11
web, release-notes
-
lists.apache.org
/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E
mailing-list
-
oracle.com
/security-alerts/cpujul2022.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2019-17495
advisory
-
github.com
/swagger-api/swagger-ui
package
-
lists.apache.org
/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91@%3Ccommits.airflow.apache.org%3E
web
-
lists.apache.org
/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf@%3Ccommits.airflow.apache.org%3E
web
-
lists.apache.org
/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96@%3Ccommits.airflow.apache.org%3E
web
-
lists.apache.org
/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f@%3Ccommits.airflow.apache.org%3E
web
-
lists.apache.org
/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f@%3Ccommits.airflow.apache.org%3E
web
-
security.snyk.io
/vuln/maven?search=CVE-2019-17495
web
Sources
- CVE List CVE-2019-17495
- GitHub Advisory GHSA-c427-hjc3-wrfw
- NVD CVE-2019-17495
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.