The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVE-2021-46708 - Medium Severity Vulnerability
[](http://badge.fury.io/js/swagger-ui-dist)
Library home page: https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-3.48.0.tgz
Path to dependency file: /barista-api/package.json
Path to vulnerable library: /barista-api/node_modules/swagger-ui-dist/package.json
Dependency Hierarchy: - swagger-ui-express-4.1.6.tgz (Root Library) - :x: **swagger-ui-dist-3.48.0.tgz** (Vulnerable Library)
Found in HEAD commit: 2b8e77b2ff0d688bfd2ffb44061287e82fa71967
Found in base branch: master
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Publish Date: 2022-03-11
URL: CVE-2021-46708
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-6c9x-mj3g-h47x
Release Date: 2022-03-11
Fix Resolution (swagger-ui-dist): 4.1.3
Direct dependency fix Resolution (swagger-ui-express): 4.2.0
:rescue_worker_helmet: Automatic Remediation is available for this issue