swagger-ui-3.2.2.tgz: 15 vulnerabilities (highest severity is: 9.8) #2
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
uriel-mend-app
bot
added
the
Mend: dependency security vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Vulnerabilities
Details
Vulnerable Library - deep-extend-0.4.1.tgz
Recursive object extending
Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.4.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/deep-extend/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Publish Date: 2018-07-03
URL: CVE-2018-3750
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Release Date: 2019-01-24
Fix Resolution (deep-extend): 0.5.1
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Publish Date: 2019-10-10
URL: CVE-2019-17495
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17495
Release Date: 2019-10-10
Fix Resolution (swagger-ui): 3.23.11
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - trim-newlines-1.0.0.tgz
Trim newlines from the start and/or end of a string
Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/trim-newlines/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Publish Date: 2021-05-28
URL: CVE-2021-33623
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623
Release Date: 2021-05-28
Fix Resolution (trim-newlines): trim-newlines - 3.0.1, 4.0.1
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - webpack-dev-server-2.5.0.tgz
Serves a webpack app. Updates the browser on changes.
Library home page: https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-2.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/webpack-dev-server/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
Publish Date: 2018-09-21
URL: CVE-2018-14732
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14732
Release Date: 2018-09-21
Fix Resolution (webpack-dev-server): 3.1.6
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Publish Date: 2019-07-18
URL: CVE-2019-1010266
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266
Release Date: 2019-07-18
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-06-07
URL: CVE-2018-3721
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721
Release Date: 2018-06-07
Fix Resolution (lodash): 4.17.5
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - autolinker-0.28.1.tgz
Utility to automatically link the URLs, email addresses, and Twitter handles in a given block of text/HTML
Library home page: https://registry.npmjs.org/autolinker/-/autolinker-0.28.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/autolinker/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
Cross-site Scripting (XSS) vulnerability was found in autolinker before 3.14.0. User input passed to the innerHTML tags isn't sanitized.
Publish Date: 2017-02-15
URL: WS-2017-3770
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2017-02-15
Fix Resolution (autolinker): autolinker - 3.14.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16487
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487
Release Date: 2019-02-01
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
Swagger-ui before 3.18.0 is vulnerable to Reverse Tabnabbing. Setting target="_blank" on anchor tags is unsafe unless used in conjunction with the rel="noopener" attribute. Opening a link via target blank attribute can change the original page, origin policy restrictions set by the browser can be bypassed.
Publish Date: 2018-08-02
URL: WS-2018-0593
CVSS 2 Score Details (5.5)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Release Date: 2019-06-17
Fix Resolution (swagger-ui): v3.18.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - yargs-parser-4.2.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608
Release Date: 2020-03-16
Fix Resolution (yargs-parser): v18.1.1;13.1.2;15.0.1
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - glob-parent-2.0.0.tgz
Strips glob magic from a string to provide the parent path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/webpack-dev-server/node_modules/glob-parent/package.json,/node_modules/glob-base/node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.
Publish Date: 2021-01-27
URL: WS-2021-0154
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2021-01-27
Fix Resolution (glob-parent): glob-parent - 5.1.2
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - autolinker-0.28.1.tgz
Utility to automatically link the URLs, email addresses, and Twitter handles in a given block of text/HTML
Library home page: https://registry.npmjs.org/autolinker/-/autolinker-0.28.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/autolinker/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
Denial of Service (DoS) vulnerability was found in autolinker before 3.0.0. Unterminated img src causes long execution.
Publish Date: 2019-01-08
URL: WS-2019-0540
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2019-01-08
Fix Resolution (autolinker): autolinker - 3.0.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting
Publish Date: 2019-02-23
URL: WS-2019-0172
CVSS 2 Score Details (5.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/976
Release Date: 2019-07-15
Fix Resolution (swagger-ui): 3.20.9
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 0153b42b3282213eb090f7cd5c6c270292fbc8ca
Found in base branch: main
Vulnerability Details
swagger-ui before 3.18.0 has Reverse Tabnapping vulnerability. using target='_blank' in anchor tags, allowing attackers to access window.opener for the original page.
Publish Date: 2018-08-02
URL: WS-2019-0171
CVSS 2 Score Details (5.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/975
Release Date: 2019-07-15
Fix Resolution (swagger-ui): 3.18.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
The text was updated successfully, but these errors were encountered: