The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVE-2021-46708 - Medium Severity Vulnerability
[](http://badge.fury.io/js/swagger-ui-dist)
Library home page: https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-4.0.0-beta.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui-dist/package.json
Dependency Hierarchy: - :x: **swagger-ui-dist-4.0.0-beta.4.tgz** (Vulnerable Library)
Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0
Found in base branch: main
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Publish Date: 2022-03-11
URL: CVE-2021-46708
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-6c9x-mj3g-h47x
Release Date: 2022-03-11
Fix Resolution: 4.1.3
Step up your Open Source Security Game with Mend here