← Back

CVE-2019-17495

nvd nist
Published: Oct 10, 2019Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Affected (17)

Smartbear
1 product
Swagger Ui
Oracle
5 products
Banking Apis
Banking Digital Experience
Banking Platform
Primavera Gateway
Utilities Framework
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Swagger Ui
Before 3.23.11
Configuration B
16 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Banking Apis
From 18.1 to 18.3
Banking Apis
Version 19.1
Banking Apis
Version 19.2
Banking Apis
Version 20.1
Banking Apis
Version 21.1
Oracle
Banking Digital Experience
From 18.1 to 18.3
Banking Digital Experience
Version 19.1
Banking Digital Experience
Version 19.2
Banking Digital Experience
Version 20.1
Banking Digital Experience
Version 21.1
Banking Platform
From 2.4.0 to 2.10.0
Oracle
Primavera Gateway
From 16.2.0 to 16.2.11
Primavera Gateway
From 17.12.0 to 17.12.8
Oracle
Utilities Framework
Version 4.3.0.6.0
Utilities Framework
Version 4.4.0.0.0
Utilities Framework
Version 4.4.0.2.0

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (22)

Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.