CVE-2016-1000229: XSS
swagger-ui has XSS in key names
Other sources
The following flaw was found in the swagger-ui library:
Swagger-ui contains a cross site scripting (XSS) vulnerability in the key names for the following object path in the JSON document:
.definitions.<USERDEFINED>.properties.<INJECTABLEKEYNAME>
Supplying a key name with script tags causes arbitrary code execution. In addition it is possible to load the arbitrary JSON files remotely via the URL query-string parameter.
Upstream bug:
https://github.com/swagger-api/swagger-ui/issues/1865
External References:
https://nodesecurity.io/advisories/126
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1000229?
CVE-2016-1000229 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-1000229?
To fix CVE-2016-1000229, update to the latest version of the swagger-ui library where the vulnerability is addressed.
Which software is affected by CVE-2016-1000229?
CVE-2016-1000229 affects the swagger-ui library, along with specific versions of Red Hat JBoss Fuse and Red Hat OpenShift.
What type of vulnerability is CVE-2016-1000229?
CVE-2016-1000229 is a cross-site scripting (XSS) vulnerability that can be exploited through malformed JSON documents.
Can CVE-2016-1000229 be exploited remotely?
Yes, CVE-2016-1000229 can be exploited remotely if an attacker can manipulate the JSON response delivered by the affected applications.