WS-2019-0172 (Medium) detected in swagger-ui-2.2.10.tgz - autoclosed

[mend-bolt-for-github]

WS-2019-0172 - Medium Severity Vulnerability

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: store/package.json

Path to vulnerable library: store/node_modules/swagger-ui/package.json

Dependency Hierarchy:

• ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 84990bf9d6b7cdf76851573df077d70766b08e91

Found in base branch: master

Vulnerability Details

swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting

Publish Date: 2019-02-23

URL: WS-2019-0172

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/976

Release Date: 2019-07-15

Fix Resolution: 3.20.9

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.