{"id":"CVE-2019-17495","details":"A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that \u003cstyle\u003e@import within the JSON data was a functional attack method.","aliases":["GHSA-c427-hjc3-wrfw"],"modified":"2026-07-08T05:56:27.109028335Z","published":"2019-10-10T22:15:10.290Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"18.1"},{"last_affected":"18.3"}],"source":"CPE_RANGE","vendor_product":"oracle:banking_apis"},{"cpes":["cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"18.1"},{"last_affected":"18.3"}],"source":"CPE_RANGE","vendor_product":"oracle:banking_digital_experience"},{"vendor_product":"oracle:banking_platform","cpes":["cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.4.0"},{"last_affected":"2.10.0"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","vendor_product":"oracle:primavera_gateway","cpes":["cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.2.0"},{"last_affected":"16.2.11"},{"introduced":"17.12.0"},{"last_affected":"17.12.8"}]},{"extracted_events":[{"introduced":"19.1"},{"last_affected":"19.1"},{"introduced":"19.2"},{"last_affected":"19.2"},{"introduced":"20.1"},{"last_affected":"20.1"},{"introduced":"21.1"},{"last_affected":"21.1"}],"source":"CPE_STRING","vendor_product":"oracle:banking_apis","cpes":["cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:banking_digital_experience","cpes":["cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"19.1"},{"last_affected":"19.1"},{"introduced":"19.2"},{"last_affected":"19.2"},{"introduced":"20.1"},{"last_affected":"20.1"},{"introduced":"21.1"},{"last_affected":"21.1"}]},{"source":"CPE_STRING","vendor_product":"oracle:utilities_framework","cpes":["cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.3.0.6.0"},{"last_affected":"4.3.0.6.0"},{"introduced":"4.4.0.0.0"},{"last_affected":"4.4.0.0.0"},{"introduced":"4.4.0.2.0"},{"last_affected":"4.4.0.2.0"}]}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"ADVISORY","url":"https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"EVIDENCE","url":"https://github.com/tarantula-team/CSS-injection-in-Swagger-UI"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/swagger-api/swagger-ui","events":[{"introduced":"0"},{"fixed":"77f4651cbf5b3767f0d79c91fd337de82b6ddee6"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.23.11"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*"}}],"versions":["v3.23.10","v3.23.9","v3.23.8","v3.23.7","v3.23.6","v3.23.5","v3.23.4","v3.23.3","v3.23.2","v3.23.1","$GIT_TAG","v3.23.0","v3.22.3","v3.22.2","v3.22.1","v3.22.0","v3.21.0","v3.20.9","v3.20.8","v3.20.7","v3.20.6","v3.20.5","v3.20.4","v3.20.3","v3.20.2","v3.20.1","v3.20.0","v3.19.5","v3.19.4","v3.19.3","v3.19.2","v3.19.1","v3.19.0","v3.18.3","v3.18.2","v3.18.1","v3.18.0","v/3.18.0","v3.17.6","v3.17.5","v3.17.4","v3.17.3","v3.17.2","v3.17.1","v3.17.0","v3.16.0","v3.15.0","v3.14.2","v3.14.1","v3.14.0","v3.13.6","v3.13.5","v3.13.4","v3.13.3","v3.13.2","v3.13.0","v3.12.1","v3.12.0","3.8.1","v3.12.9","v3.11.0","v3.10.0","v3.9.2","v3.9.1","v3.9.0","v3.8.1","v3.8.0","v3.7.0","v3.6.1","v3.6.0","v3.5.0","v3.4.5","v3.4.4","v3.4.3","v3.4.1","v3.4.2","v3.4.0","v3.3.2","v3.3.1","3.3.1","v3.3.0","v3.2.2","v3.2.1","v3.2.0","v3.1.7","v3.1.6","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.21","v3.0.20","v3.0.19","v3.0.18","v3.0.16","v3.0.17","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.2","v3.0.1","v3.0.0","v2.2.10","v2.2.9","v2.2.8","v2.2.7","v2.2.6","v2.2.5","v2.2.4","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.1.5-M2","v2.1.2-M2","v2.1.4-M2","v2.1.3-M2","v2.1.1-M2","v2.1.0-M2","v2.1.8-M1","v2.1.7-M1","v2.1.6-M1","v2.1.5-M1","v2.1.4-M1","v2.1.3-M1","v2.1.2-M1","v2.1.1-M1","v2.1.0-M1","v2.1.0-alpha.6","v2.1.0-alpha.5","v2.1.0-alpha.4","v2.1.0-alpha.1","v2.0.24","v2.0.22","v2.0.21","v2.0.20","v2.0.19","v2.0.18","v2.0.17","v2.0.16","v2.0.15","v2.0.14","v2.0.12","v2.0.11","v2.0.10","v2.0.9","v2.0.8","v2.0.7","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.1.15","v1.0.13","v1.0.12","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.1","v1.0.1","v1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17495.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}