← Back

CVE-2019-17495

nvd nist
Published: Oct 10, 2019Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Affected (17)

Smartbear
1 product
Swagger Ui
Oracle
5 products
Banking Apis
Banking Digital Experience
Banking Platform
Primavera Gateway
Utilities Framework
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Swagger Ui
version < 3.23.11
Configuration B
16 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Banking Apis
18.1 ≤ version ≤ 18.3
Banking Apis
Version 19.1
Banking Apis
Version 19.2
Banking Apis
Version 20.1
Banking Apis
Version 21.1
Oracle
Banking Digital Experience
18.1 ≤ version ≤ 18.3
Banking Digital Experience
Version 19.1
Banking Digital Experience
Version 19.2
Banking Digital Experience
Version 20.1
Banking Digital Experience
Version 21.1
Banking Platform
2.4.0 ≤ version ≤ 2.10.0
Oracle
Primavera Gateway
16.2.0 ≤ version ≤ 16.2.11
Primavera Gateway
17.12.0 ≤ version ≤ 17.12.8
Oracle
Utilities Framework
Version 4.3.0.6.0
Utilities Framework
Version 4.4.0.0.0
Utilities Framework
Version 4.4.0.2.0

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (22)

Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.