CVE-2019-17495 (Critical) detected in springfox-swagger-ui-2.7.0.jar

[mend-for-github-com[bot]]

CVE-2019-17495 - Critical Severity Vulnerability

Vulnerable Library - springfox-swagger-ui-2.7.0.jar

JSON API documentation for spring based applications

Library home page: https://github.com/springfox/springfox

Path to dependency file: /api/pacman-api-statistics/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar,/home/wss-scanner/.m2/repository/io/springfox/springfox-swagger-ui/2.7.0/springfox-swagger-ui-2.7.0.jar

Dependency Hierarchy: - :x: **springfox-swagger-ui-2.7.0.jar** (Vulnerable Library)

Found in HEAD commit: acf9a0620c1a37cee4f2896d71e1c3731c5c7b06

Found in base branch: master

Vulnerability Details

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that