GHSA-4f9m-pxwh-68hg

Suggest an improvement
Source
https://github.com/advisories/GHSA-4f9m-pxwh-68hg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4f9m-pxwh-68hg/GHSA-4f9m-pxwh-68hg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4f9m-pxwh-68hg
Downstream
Published
2020-09-11T21:20:14Z
Modified
2021-09-28T16:57:07Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Cross-Site Scripting in swagger-ui
Details

Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.

Recommendation

Upgrade to version 3.20.9 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:42:43Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / swagger-ui

Package

Name
swagger-ui
View open source insights on deps.dev
Purl
pkg:npm/swagger-ui

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.20.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4f9m-pxwh-68hg/GHSA-4f9m-pxwh-68hg.json"