REDHAT-BUG-1360275: XSS

Published Jul 26, 2016

Updated

The following flaw was found in the swagger-ui library:

Swagger-ui contains a cross site scripting (XSS) vulnerability in the key names for the following object path in the JSON document:

.definitions.<USERDEFINED>.properties.<INJECTABLEKEYNAME>

Supplying a key name with script tags causes arbitrary code execution. In addition it is possible to load the arbitrary JSON files remotely via the URL query-string parameter.

Upstream bug:

https://github.com/swagger-api/swagger-ui/issues/1865

External References:

https://nodesecurity.io/advisories/126

Affected Software

1 affected component

Swagger swagger-ui

Event History

Jul 26, 2016

Data Sourced

via Red Hat·11:48 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1360275?

The severity of REDHAT-BUG-1360275 is considered high due to its potential for cross site scripting (XSS) attacks.

How do I fix REDHAT-BUG-1360275?

To fix REDHAT-BUG-1360275, update the swagger-ui library to the latest version which addresses the XSS vulnerability.

What causes the REDHAT-BUG-1360275 vulnerability?

REDHAT-BUG-1360275 is caused by improper handling of user-defined key names in the swagger-ui JSON document, allowing for script injection.

Who is affected by REDHAT-BUG-1360275?

Users of the swagger-ui library, especially those who allow user-defined input for key names, are affected by REDHAT-BUG-1360275.

Is there a CVE associated with REDHAT-BUG-1360275?

As of now, there is no CVE linked to REDHAT-BUG-1360275.