Back
CVE-2019-17495
CRITICAL
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Published: Oct 10, 2019
Modified: Jun 17, 2026
CWE-352
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (17)
| Vendor | Product | Version |
|---|---|---|
| smartbear | swagger_ui | * < 3.23.11 |
| oracle | banking_apis | * ≥ 18.1 |
| oracle | banking_apis | 19.1 |
| oracle | banking_apis | 19.2 |
| oracle | banking_apis | 20.1 |
| oracle | banking_apis | 21.1 |
| oracle | banking_digital_experience | * ≥ 18.1 |
| oracle | banking_digital_experience | 19.1 |
| oracle | banking_digital_experience | 19.2 |
| oracle | banking_digital_experience | 20.1 |
| oracle | banking_digital_experience | 21.1 |
| oracle | banking_platform | * ≥ 2.4.0 |
| oracle | primavera_gateway | * ≥ 16.2.0 |
| oracle | primavera_gateway | * ≥ 17.12.0 |
| oracle | utilities_framework | 4.3.0.6.0 |
| oracle | utilities_framework | 4.4.0.0.0 |
| oracle | utilities_framework | 4.4.0.2.0 |
GitHub Security Advisory GHSA-c427-hjc3-wrfw
Cross-site scripting in Swagger-UI
npm
swagger-ui
< 3.23.11
Fixed: 3.23.11
maven
org.webjars:swagger-ui
< 3.23.11
Fixed: 3.23.11
maven
org.webjars.npm:swagger-ui
< 3.23.11
Fixed: 3.23.11
maven
io.springfox:springfox-swagger-ui
< 2.10.0
Fixed: 2.10.0
References (22)
- https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11 Release Notes
- https://github.com/tarantula-team/CSS-injection-in-Swagger-UI Exploit, Third Party Advisory
- https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.html Patch, Third Party Advisory
- https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11 Release Notes
- https://github.com/tarantula-team/CSS-injection-in-Swagger-UI Exploit, Third Party Advisory
- https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
5.73%
Top 7% most likely to be exploited
Threat Score
40.9 / 100
Data Sources
NVD
EPSS
GitHub