VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Oct 10, 2019· Updated Jun 17, 2026

CVE-2019-17495

CVE-2019-17495

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that @import within the JSON data was a functional attack method.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
swagger-uinpm
< 3.23.113.23.11
org.webjars:swagger-uiMaven
< 3.23.113.23.11
org.webjars.npm:swagger-uiMaven
< 3.23.113.23.11
io.springfox:springfox-swagger-uiMaven
< 2.10.02.10.0

Affected products

21
  • Oracle Corporation/Banking Apis5 versions
    cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*range: >=18.1,<=18.3
    • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Digital Experience5 versions
    cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*range: >=18.1,<=18.3
    • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Platform
    cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*
    Range: >=2.4.0,<=2.10.0
  • Oracle Corporation/Primavera Gateway
    cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
    Range: >=16.2.0,<=16.2.11
  • Oracle Corporation/Utilities Framework3 versions
    cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*
  • Smartbear/Swagger UI
    cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
    Range: <3.23.11
  • Swagger/Swagger UIdescription
  • ghsa-coords4 versions
    pkg:maven/io.springfox/springfox-swagger-uipkg:maven/org.webjars.npm/swagger-uipkg:maven/org.webjars/swagger-uipkg:npm/swagger-ui
    < 2.10.0+ 3 more
    • (no CPE)range: < 2.10.0
    • (no CPE)range: < 3.23.11
    • (no CPE)range: < 3.23.11
    • (no CPE)range: < 3.23.11

Patches

Vulnerability mechanics

References

19

News mentions

0

No linked articles in our index yet.