A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11…
Priority MEDIUM 51CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering, Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-79.
Summary
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Why it matters now
EPSS 0.05734 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed swagger-ui (npm): 3.23.11org.webjars:swagger-ui (Maven): 3.23.11+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | swagger-ui (npm) | before 3.23.11 | 3.23.11 | Patch available | GHSA-c427-hjc3-wrfw |
| — | org.webjars:swagger-ui (Maven) | before 3.23.11 | 3.23.11 | Patch available | GHSA-c427-hjc3-wrfw |
| — | org.webjars.npm:swagger-ui (Maven) | before 3.23.11 | 3.23.11 | Patch available | GHSA-c427-hjc3-wrfw |
| — | io.springfox:springfox-swagger-ui (Maven) | before 2.10.0 | 2.10.0 | Patch available | GHSA-c427-hjc3-wrfw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- swagger-ui (npm) Vendor— Affected before 3.23.11 Fixed in 3.23.11 Patch available GHSA-c427-hjc3-wrfw
- org.webjars:swagger-ui (Maven) Vendor— Affected before 3.23.11 Fixed in 3.23.11 Patch available GHSA-c427-hjc3-wrfw
- org.webjars.npm:swagger-ui (Maven) Vendor— Affected before 3.23.11 Fixed in 3.23.11 Patch available GHSA-c427-hjc3-wrfw
- io.springfox:springfox-swagger-ui (Maven) Vendor— Affected before 2.10.0 Fixed in 2.10.0 Patch available GHSA-c427-hjc3-wrfw
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:* | before 3.23.11 | Vulnerable | SMARTBEAR |
| cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* | 18.1 – 18.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* | 20.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* | 21.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* | 18.1 – 18.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* | 20.1 | Vulnerable | Oracle |
- cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:* Versions before 3.23.11 Vulnerable ·SMARTBEAR
- cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* | 21.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* | 2.4.0 – 2.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 16.2.0 – 16.2.11; 17.12.0 – 17.12.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* | 4.3.0.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* | 4.4.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* | 4.4.0.2.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* Versions 2.4.0 – 2.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 16.2.0 – 16.2.11; 17.12.0 – 17.12.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* Versions 4.3.0.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-c427-hjc3-wrfw swagger-ui (npm) Fixed in 3.23.11 Advisory →
- Fix · GHSA-c427-hjc3-wrfw org.webjars:swagger-ui (Maven) Fixed in 3.23.11 Advisory →
- Fix · GHSA-c427-hjc3-wrfw org.webjars.npm:swagger-ui (Maven) Fixed in 3.23.11 Advisory →
- Fix · GHSA-c427-hjc3-wrfw io.springfox:springfox-swagger-ui (Maven) Fixed in 2.10.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17495
- 2026-10-03 Alias added: GHSA-c427-hjc3-wrfw
References
Patch 3
Other 14
- https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
- [airflow-commits] 20210920 [GitHub] [airflow] boring-cyborg[bot] commented on issue #18383: CVE-2019-17495 for swagger-ui
- [airflow-commits] 20210920 [GitHub] [airflow] beltran-rubo opened a new issue #18383: CVE-2019-17495 for swagger-ui
- [airflow-commits] 20210920 [GitHub] [airflow] uranusjr commented on issue #18383: CVE-2019-17495 for swagger-ui
- [airflow-commits] 20210921 [GitHub] [airflow] beltran-rubo commented on issue #18383: CVE-2019-17495 for swagger-ui
- [airflow-commits] 20210921 [GitHub] [airflow] beltran-rubo closed issue #18383: CVE-2019-17495 for swagger-ui
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/springfox/springfox/commit/26f72f0d16b166e12c20255a4ee907dc10685cf8
- https://github.com/swagger-api/swagger-ui
- https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f@%3Ccommits.airflow.apache.org%3E
Sources
- CVE-2019-17495 · CVE Program
- CVE-2019-17495 · NVD
- FIRST EPSS
- GHSA-c427-hjc3-wrfw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences