WS-2016-0034 (High) detected in swagger-ui-2.0.2.js - autoclosed

[mend-bolt-for-github]

WS-2016-0034 - High Severity Vulnerability

Vulnerable Library - swagger-ui-2.0.2.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.0.2/swagger-ui.js

Path to dependency file: /node_modules/swagger-node-express/swagger-ui/index.html

Path to vulnerable library: /node_modules/swagger-node-express/swagger-ui/swagger-ui.js,/api/node_modules/swagger-node-express/swagger-ui/swagger-ui.js

Dependency Hierarchy:

• ❌ swagger-ui-2.0.2.js (Vulnerable Library)

Found in HEAD commit: 25e18f75201eb2d7b67db4fd55e7c5c7bf6479b5

Found in base branch: master

Vulnerability Details

Swagger-ui has vulnerability when "Produces" and "consumes" Content-types in schema are not escaped and allow XSS

Publish Date: 2016-01-13

URL: WS-2016-0034

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2016-01-13

Fix Resolution: v2.1.5

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.