CVE-2019-17495 - CVE House

Back to Database

Status published Critical CVE-2019-17495

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI...

9.8 CVSS

Vulnerability Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17495

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from smartbear

View All →

The swagger-ui-dist package before 4.1.3 for Node.js could allow a...

SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in...

In SmartBear Collaborator Server through 13.3.13302, use of the Google...

An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5....

An issue was discovered in SmartBear ReadyAPI through 2.8.2 and...

Affected Vendor

smartbear

View all reports →

Affected Software

swagger ui, banking apis, banking digital experience, banking platform, primavera gateway, utilities framework

Vulnerable Versions:

0, 18.1, 19.1, 19.2, 20.1, 21.1, 2.4.0, 16.2.0, 17.12.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0

Timeline

Official Publish: October 10th, 2019

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.