WS-2016-0034 (High) detected in swagger-ui-2.1.2.min.js

[mend-for-github-com]

WS-2016-0034 - High Severity Vulnerability

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Path to vulnerable library: AltoroJ 3.1.1/WebContent/swagger/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: 9d9c490b725f82968c9422eb877090338257eb6b

Found in base branch: master

Vulnerability Details

Swagger-ui has vulnerability when "Produces" and "consumes" Content-types in schema are not escaped and allow XSS

Publish Date: 2016-01-13

URL: WS-2016-0034

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: swagger-api/swagger-ui#1866

Release Date: 2016-01-13

Fix Resolution: v2.1.5